HI !
After upgrade to graylog 2.5 version i get sometimes messages like this in log:
2019-02-14T13:07:25.835+06:00 WARN [ProxiedResource] Unable to call http://127.0.0.1:9000/api/system/metrics/multiple on node <0c9a1464-c6ee-4506-8de2-55e326ecd389>
java.net.SocketTimeoutException: timeout
And graylog dont write messages to elasticsearch. Restart help. But it bad workaround, i think.
Additional information:
sysadmin@graylog:~$ curl -I 'http://127.0.0.1:9000/api/system'
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Basic realm="Graylog Server"
X-Graylog-Node-ID: 0c9a1464-c6ee-4506-8de2-55e326ecd389
X-Runtime-Microseconds: 1561
Content-Length: 0
Date: Thu, 14 Feb 2019 10:48:46 GMT
sysadmin@graylog:~$ curl -I 'http://127.0.0.1:9000/api/?pretty=true'
HTTP/1.1 200 OK
X-Graylog-Node-ID: 0c9a1464-c6ee-4506-8de2-55e326ecd389
X-Runtime-Microseconds: 2323
Content-Length: 253
Content-Type: application/json
Date: Thu, 14 Feb 2019 10:48:51 GMT
rest_listen_uri = http://127.0.0.1:9000/api/
web_listen_uri = http://127.0.0.1:9000/
web_endpoint_uri = https://graylog.mydomain.com/api/
UPD: up graylog memory from 4 to 8 Gb, it doesn’t help.
Today one of programmers do search query to index on elastic warm node and graylog stuck with api unavailable.
UPD: Problem is in requests to warm node of elasticsearch, heavy requests make graylog unusable for a some time. Is it possible to limit the queries or the output of information in the configuration of graylog ?