Possible bracketless IPv6 literal Graylog 3.0

Graylog Central (peer support)
1 
graylog_1        | 2019-01-24 16:45:11,714 ERROR: org.graylog2.bootstrap.CmdLineTool - Invalid configuration
graylog_1        | com.github.joschi.jadconfig.ValidationException: java.lang.IllegalArgumentException: Possible bracketless IPv6 literal: http://0.0.0.0:9000/api
graylog_1        |      at org.graylog2.configuration.HttpConfiguration.validateHttpBindAddress(HttpConfiguration.java:227) ~[graylog.jar:?]
graylog_1        |      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_181]
graylog_1        |      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_181]
graylog_1        |      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_181]
graylog_1        |      at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_181]
graylog_1        |      at com.github.joschi.jadconfig.ReflectionUtils.invokeMethodsWithAnnotation(ReflectionUtils.java:53) ~[graylog.jar:?]
graylog_1        |      at com.github.joschi.jadconfig.JadConfig.invokeValidatorMethods(JadConfig.java:221) ~[graylog.jar:?]
graylog_1        |      at com.github.joschi.jadconfig.JadConfig.process(JadConfig.java:100) ~[graylog.jar:?]
graylog_1        |      at org.graylog2.bootstrap.CmdLineTool.processConfiguration(CmdLineTool.java:351) [graylog.jar:?]
graylog_1        |      at org.graylog2.bootstrap.CmdLineTool.readConfiguration(CmdLineTool.java:344) [graylog.jar:?]
graylog_1        |      at org.graylog2.bootstrap.CmdLineTool.run(CmdLineTool.java:178) [graylog.jar:?]
graylog_1        |      at org.graylog2.bootstrap.Main.main(Main.java:44) [graylog.jar:?]
graylog_1        | Caused by: java.lang.IllegalArgumentException: Possible bracketless IPv6 literal: http://0.0.0.0:9000/api
graylog_1        |      at com.google.common.base.Preconditions.checkArgument(Preconditions.java:216) ~[graylog.jar:?]
graylog_1        |      at com.google.common.net.HostAndPort.requireBracketsForIPv6(HostAndPort.java:275) ~[graylog.jar:?]
graylog_1        |      at org.graylog2.configuration.HttpConfiguration.getHttpBindAddress(HttpConfiguration.java:88) ~[graylog.jar:?]
graylog_1        |      at org.graylog2.configuration.HttpConfiguration.validateHttpBindAddress(HttpConfiguration.java:222) ~[graylog.jar:?]
graylog_1        |      ... 11 more

I tried using the actual ip instead of wildcard 0.0.0.0 also, same thing. I think it thinks it might be an ipV6 because of the :9000 port? I don’t know.

If I do it without the port, then it throws:

graylog_1        | 2019-01-24 16:47:53,445 ERROR: org.graylog2.bootstrap.CmdLineTool - Invalid configuration
graylog_1        | com.github.joschi.jadconfig.ParameterException: Couldn't convert value for parameter "http_bind_address"
graylog_1        |      at com.github.joschi.jadconfig.JadConfig.processClassFields(JadConfig.java:141) ~[graylog.jar:?]
graylog_1        |      at com.github.joschi.jadconfig.JadConfig.process(JadConfig.java:99) ~[graylog.jar:?]

graylog_1        |      at org.graylog2.bootstrap.CmdLineTool.processConfiguration(CmdLineTool.java:351) [graylog.jar:?]
graylog_1        |      at org.graylog2.bootstrap.CmdLineTool.readConfiguration(CmdLineTool.java:344) [graylog.jar:?]
graylog_1        |      at org.graylog2.bootstrap.CmdLineTool.run(CmdLineTool.java:178) [graylog.jar:?]
graylog_1        |      at org.graylog2.bootstrap.Main.main(Main.java:44) [graylog.jar:?]
graylog_1        | Caused by: com.github.joschi.jadconfig.ParameterException: Couldn't convert value "http://0.0.0.0/api" to HostAndPort.
graylog_1        |      at com.github.joschi.jadconfig.guava.converters.HostAndPortConverter.convertFrom(HostAndPortConverter.java:25) ~[graylog.jar:?]
graylog_1        |      at com.github.joschi.jadconfig.guava.converters.HostAndPortConverter.convertFrom(HostAndPortConverter.java:10) ~[graylog.jar:?]
graylog_1        |      at com.github.joschi.jadconfig.JadConfig.convertStringValue(JadConfig.java:167) ~[graylog.jar:?]
graylog_1        |      at com.github.joschi.jadconfig.JadConfig.processClassFields(JadConfig.java:139) ~[graylog.jar:?]
graylog_1        |      ... 5 more
graylog_1        | Caused by: java.lang.IllegalArgumentException: Unparseable port number: http://0.0.0.0/api
graylog_1        |      at com.google.common.net.HostAndPort.fromString(HostAndPort.java:196) ~[graylog.jar:?]
graylog_1        |      at com.github.joschi.jadconfig.guava.converters.HostAndPortConverter.convertFrom(HostAndPortConverter.java:23) ~[graylog.jar:?]
graylog_1        |      at com.github.joschi.jadconfig.guava.converters.HostAndPortConverter.convertFrom(HostAndPortConverter.java:10) ~[graylog.jar:?]
graylog_1        |      at com.github.joschi.jadconfig.JadConfig.convertStringValue(JadConfig.java:167) ~[graylog.jar:?]
graylog_1        |      at com.github.joschi.jadconfig.JadConfig.processClassFields(JadConfig.java:139) ~[graylog.jar:?]
graylog_1        |      ... 5 more
2

Are you using the latest beta release of Graylog 3.0?

If so, you may want to file this as an issue over on the Github repo: https://github.com/Graylog2/graylog2-server/issues

3

I’m not sure if it’s the latest.

I am using the docker image graylog/graylog:3.0

4

go to “System > Nodes > NODESNAME” to find the version you are using.

How did you try to configure the settings? That would help to understand what happens.

5

graylog/graylog:3.0

That is a docker image we do not provide …

Docker you can see all available images.

6

I can not access that because I don’t have access to the web frontend, Graylog shuts down due to the error in the OP.

7

Strange, I don’t know what exactly it was pulling then but that is the exact string I was using.

I am now using graylog/graylog:3.0.0-beta.3-1 and it is indeed a different image and the error still persists and is the same.

8

The plugins loaded have the “Loaded plugin: Threat Intelligence Plugin 3.0.0-beta.3” 3.0.0-beta.3 tag in them so I assume that is the version of Grayson.

9

I configured the image by following this link http://docs.graylog.org/en/2.5/pages/installation/docker.html , using the ’ Custom configuration files’ section. The only thing I changed was added http_bind_address = http://0.0.0.0:9000/api and removed web_listen_uri. I suppose the config might be causing issues since it is meant for Graylog2.

10

When trying to switch to 2.5 or lower I get another error without really touching anything. This is after pruning docker with --all…

graylog_1 | 2019-01-24 20:11:00,144 ERROR: org.graylog2.bootstrap.CmdLineTool - Guice error (more detail on log level debug): Error injecting constructor, java.lang.RuntimeException: IOException encountered while reading from a byte array input stream

…

graylog_1        | Caused by: com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException: Unrecognized field "field_type_refresh_interval" (class org.graylog2.indexer.indexset.AutoValue_IndexSetConfig), not marked as ignorable (17 known properties: "index_optimization_disabled", "index_template_name", "index_wildcard", "index_match_pattern", "rotation_strategy_class", "creation_date", "index_analyzer", "rotation_strategy", "shards", "title", "index_optimization_max_num_segments", "_id", "replicas", "description", "index_prefix", "retention_strategy_class", "retention_strategy"])
graylog_1        |  at [Source: de.undercouch.bson4jackson.io.LittleEndianInputStream@1f521c69; pos: 826] (through reference chain: org.graylog2.indexer.indexset.AutoValue_IndexSetConfig["field_type_refresh_interval"])

The only related issues I’ve found are https://github.com/Graylog2/graylog2-server/issues/4775 and https://github.com/Graylog2/graylog2-server/issues/3267 but they don’t offer a solution

11

how does your docker run or docker compose look like?

For the Graylog 2.5 Docker configuration please check the documentation: http://docs.graylog.org/en/2.5/pages/installation/docker.html

and for 3.0 the only important change is the already noticed setting.

12 
    mongo:
            image: "mongo:3"
            volumes:
                    - .mongo:/data/db
    elasticsearch:
            image: docker.elastic.co/elasticsearch/elasticsearch:6.5.4
            environment:
                    - http.host=0.0.0.0
                    - transport.host=localhost
                    - network.host=0.0.0.0
                    - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
            volumes:
                    - elasticsearch:/usr/share/elasticsearch/data
    graylog:
            #image: graylog/graylog:3.0.0-beta.3-1
            image: graylog/graylog:2.5
            volumes:
                    - ./graylog/data/journal:/usr/share/graylog/data/journal
                    - ./graylog/config:/usr/share/graylog/data/config
            depends_on:
                    - mongo
                    - elasticsearch
            ports:
                    - "9000:9000"
                    - "12201:12201"
                    - "1514:1514"
                    - "514:514/udp"

I’m running out of ideas on what else to try at this point.

13

Did you cleaned the MongoDB after your “downgrade” ?

How did you link the containers?

14

and just to mention

version: '2'
services:
  # MongoDB: https://hub.docker.com/_/mongo/
  mongodb:
    image: mongo:3
  # Elasticsearch: https://www.elastic.co/guide/en/elasticsearch/reference/5.6/docker.html
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch-oss:6.5.4
    environment:
      - http.host=0.0.0.0
      - transport.host=localhost
      - network.host=0.0.0.0
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    mem_limit: 1g
  # Graylog: https://hub.docker.com/r/graylog/graylog/
  graylog:
    image: graylog/graylog:3.0.0-beta.4-1
    environment:
      # CHANGE ME!
      - GRAYLOG_PASSWORD_SECRET=somepasswordpepper
      # Password: admin
      - GRAYLOG_ROOT_PASSWORD_SHA2=8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918
      - GRAYLOG_HTTP_BIND_ADDRESS=127.0.0.1:9000
    links:
      - mongodb:mongo
      - elasticsearch
    depends_on:
      - mongodb
      - elasticsearch
    ports:
      # Graylog web interface and REST API
      - 9000:9000
      # Syslog TCP
      - 514:514
      # Syslog UDP
      - 514:514/udp
      # GELF TCP
      - 12201:12201
      # GELF UDP
      - 12201:12201/udp

the above is working for me. Please see GRAYLOG_HTTP_BIND_ADDRESS=127.0.0.1:9000 it is only ip and port - no http/https. URi Settings are now http_external_uri and http_publish_uri.