Not able to start the stream log via API

(Som Shekhar Sharma) #1

I am using Graylog docker and trying to create the stream and starting it via service file.
I am creating the streams entry in the mongoDB as follows in ExecStartPost: (Following snippet is part of my service file)

ExecStartPost = /bin/bash -c "sleep 40;docker exec -i d_mongo mongo graylog --eval 
ID=ObjectId();db.streams.insert({\"_id\":ID,\"creator_user_id\" : \"admin\", \"matching_type\" : \"OR\", \"description\" : \"\",\"disabled\" : false, \"title\" : \"All Logs\",\"content_pack\" : null,\"created_at\":new ISODate()});db.streamrules.insert({\"field\" : \"container_name\",\"stream_id\" : ID,\"description\" : \"\", \"type\" : 2,\"inverted\" : false, \"value\" : \"*.*\"});"

And starting the streams via API as follows in ExecStartPost

ExecStartPost=/bin/bash -c   "sleep 70; docker exec -i d_graylog  curl  -u XX:XXXX -g -X POST`curl  -u XX:XXXX -X GET  | sed 's/{.*stream_id\":\"*\([0-9a-zA-Z]*\)\"*,*.*}/\1/'`/resume"

Since commands in ExecStartPost starts simultaneously, so I have given proper sleep command so that one start after the other.

When the docker starts, I see the following exception in the GrayLog’s log.

 ERROR: org.graylog2.streams.StreamRouter - Stream router engine update failed!
 java.lang.ClassCastException: java.lang.Double cannot be cast to java.lang.Integer
at org.graylog2.streams.StreamRuleImpl.getType( ~[graylog.jar:?]
 at org.graylog2.streams.StreamRouterEngine$Rule.<init>( ~[graylog.jar:?]
 at org.graylog2.streams.StreamRouterEngine.<init>( ~[graylog.jar:?]
 at org.graylog2.streams.StreamRouterEngine$$FastClassByGuice$$c6190f39.newInstance(<generated>) ~[graylog.jar:?]
 at$FastClassProxy.newInstance( ~[graylog.jar:?]
at ~[graylog.jar:?]
 at ~[graylog.jar:?]
 at$Factory.get( ~[graylog.jar:?]
at$2$ ~[graylog.jar:?]
at ~[graylog.jar:?]
at$2.get( ~[graylog.jar:?]
at ~[graylog.jar:?]
at com.sun.proxy.$Proxy73.create(Unknown Source) ~[?:?]
at org.graylog2.streams.StreamRouter$StreamRouterEngineUpdater.getNewEngine( ~[graylog.jar:?]
 at org.graylog2.streams.StreamRouter$ [graylog.jar:?]
 at java.util.concurrent.Executors$ [?:1.8.0_102]
at [?:1.8.0_102]
 at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201( [?:1.8.0_102]
 at java.util.concurrent.ScheduledThreadPoolExecutor$ [?:1.8.0_102]
 at java.util.concurrent.ThreadPoolExecutor.runWorker( [?:1.8.0_102]
 at java.util.concurrent.ThreadPoolExecutor$ [?:1.8.0_102]
at [?:1.8.0_102]

Now if i visit the Graylog UI, I see that stream which i have created is in resume state but i don’t see any logs coming. Then I open the stream rules and just save it without doing any modification and the stream starts getting the data.
Not sure where I am going wrong.

(Jochen) #2

Please use content packs and the content pack autoloader for automatically creating streams (and other entities) in Graylog on startup.

Manually editing the MongoDB database is explicitly discouraged.