# No results on search page

**URL:** <https://community.graylog.org/t/no-results-on-search-page/11081>\
**Category:** Graylog Central (peer support)\
**Created:** [July 7, 2019, 3:41pm UTC](https://community.graylog.org/t/no-results-on-search-page/11081 "2019-07-07T15:41:01Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![natej](https://avatars.discourse-cdn.com/v4/letter/n/b4bc9f/32.png) [@natej](https://community.graylog.org/u/natej)\
**Post date:** [July 7, 2019, 3:41pm UTC](https://community.graylog.org/t/no-results-on-search-page/11081/1 "2019-07-07T15:41:01Z")

</div>

Hi Graylog community,

I’ve installed and configured Graylog 3.0.2 and have messages being sent to a GELF UDP input.

The messages are being accepted and inserted into Elasticsearch. There are no errors in the Graylog server log and I can see the messages using Kibana. Actually, I used Kibana to help me troubleshoot the timestamp field I’m sending to the GELF UDP input. Initially, I was sending messages using local time, but now I have the timestamp being sent in UTC. I can see messages in Kibana as soon as they’re sent and Kibana adjusts the timestamp correctly to local time.

However, I still don’t see any messages on the search page. I’ve tried adjusting the time period to “All messages”, but still no results. I’ve done this logged in as the admin (root) user. I have the root user’s timezone set to EST currently and have also tried UTC, but still no results. I’ve also waited a day to make sure the message timestamps aren’t in the future and being filtered.

The really interesting thing though is, I can send the query myself to Elasticsearch on port 9200 using the query data from the “Elasticsearch query” link on the page and get results. So I don’t know why this is returning 0 results on the search page. I’ve also tried entering a search term that I know is in the message content and that doesn’t work either. If I try this same search term in Kibana, I get results.

If anyone has any ideas on what I should look at or try so I can get search results, I’d really appreciate it. I don’t know what to look at next.

Thanks

---

<div class="post-metadata">

**Author:** ![natej](https://avatars.discourse-cdn.com/v4/letter/n/b4bc9f/32.png) [@natej](https://community.graylog.org/u/natej)\
**Post date:** [July 8, 2019, 2:36am UTC](https://community.graylog.org/t/no-results-on-search-page/11081/2 "2019-07-08T02:36:38Z")

</div>

Well, I have an interesting update. I can see search results now. They’re beautiful! 🙂

I haven’t changed any configuration, Graylog or otherwise. But I did notice that the index rolled over. The active write index changed from `graylog_0` to `graylog_1` (I have 2 indices now).

The only other thing I can think of is, before I fixed the timestamp and started sending messages with timestamps in UTC, I manually deleted docs from the `graylog_0` index via the Elasticsearch API. I don’t know if this could explain why I wasn’t seeing search results. My guess is that once the index rolled over and the active write index changed to `graylog_1`, that’s when things started working.

Also, another page that’s working now that wasn’t before is the Source page. It wasn’t showing a list of message sources, but just like the Search page, it’s working now too.

Thanks

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [July 8, 2019, 6:16am UTC](https://community.graylog.org/t/no-results-on-search-page/11081/3 "2019-07-08T06:16:03Z")

</div>

he @natej

actually you had only to to the 'recalculate index range` in system \> indices - because Graylog wasn’t aware of the data in elasticsearch.

such happens and the fix is easy as you see. The same happens automatically on index rotate that is why you see them now.

---

<div class="post-metadata">

**Author:** ![natej](https://avatars.discourse-cdn.com/v4/letter/n/b4bc9f/32.png) [@natej](https://community.graylog.org/u/natej)\
**Post date:** [July 10, 2019, 4:23am UTC](https://community.graylog.org/t/no-results-on-search-page/11081/4 "2019-07-10T04:23:59Z")

</div>

Ah, yes, thanks for that. I’ll definitely remember that for next time.

Thanks for your help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [July 24, 2019, 4:29am UTC](https://community.graylog.org/t/no-results-on-search-page/11081/5 "2019-07-24T04:29:17Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.