Query does not support max_determinized states

Hi There,
I am doing POC on Graylog to consolidate the logs files in a cluster environment. Could you please help me out here to send the application log files(It’s a text file) to Graylog server as I am getting the following error.

2020-07-22T16:36:31.414+04:00 ERROR [IndexerClusterCheckerThread] Uncaught exception in periodical
java.lang.IllegalArgumentException: Cat response did not contain a JSON Array
at io.searchbox.core.Cat.parseResponseBody(Cat.java:61) ~[graylog.jar:?]
at io.searchbox.action.AbstractAction.createNewElasticSearchResult(AbstractAction.java:71) ~[graylog.jar:?]
at io.searchbox.core.Cat.createNewElasticSearchResult(Cat.java:44) ~[graylog.jar:?]
at io.searchbox.core.Cat.createNewElasticSearchResult(Cat.java:16) ~[graylog.jar:?]
at io.searchbox.client.http.JestHttpClient.deserializeResponse(JestHttpClient.java:212) ~[graylog.jar:?]
at io.searchbox.client.http.JestHttpClient.execute(JestHttpClient.java:88) ~[graylog.jar:?]
at org.graylog2.indexer.cluster.jest.JestUtils.execute(JestUtils.java:49) ~[graylog.jar:?]
at org.graylog2.indexer.cluster.jest.JestUtils.execute(JestUtils.java:65) ~[graylog.jar:?]
at org.graylog2.indexer.cluster.Cluster.catNodes(Cluster.java:128) ~[graylog.jar:?]
at org.graylog2.indexer.cluster.Cluster.getFileDescriptorStats(Cluster.java:133) ~[graylog.jar:?]
at org.graylog2.periodical.IndexerClusterCheckerThread.checkOpenFiles(IndexerClusterCheckerThread.java:73) ~[graylog.jar:?]
at org.graylog2.periodical.IndexerClusterCheckerThread.doRun(IndexerClusterCheckerThread.java:62) ~[graylog.jar:?]
at org.graylog2.plugin.periodical.Periodical.run(Periodical.java:77) [graylog.jar:?]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_252]
at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308) [?:1.8.0_252]
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180) [?:1.8.0_252]
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294) [?:1.8.0_252]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_252]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_252]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_252]

We have installed following versions of Graylag and its prerequisites libraries.

  1. elasticsearch-5.0.0.rpm
  2. filebeat-7.8.0-x86_64.rpm
  3. graylog-enterprise-integrations-plugins-3.3.2-1.noarch.rpm
  4. graylog-enterprise-plugins-3.3.2-1.noarch.rpm
  5. graylog-integrations-plugins-3.3.2-1.noarch.rpm
  6. graylog-server-3.3.2-1.noarch.rpm
  7. graylog-sidecar-1.0.2-1.x86_64.rpm
  8. mongodb-org-server-4.2.8-1.el7.x86_64.rpm

you should really upgrade to elasticsearch 6.x - the latest release. It is very likely that the next version of Graylog will drop ES5 support and you would need to make the elasticsearch upgrade …

It might be that this feature is not working in this very old and EOL elasticsearch version.

Thanks Jan for the quick responses :slight_smile:

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.