QuickValues not working on 2.5.1

Hi,

I am running Graylog 2.5.1. Prior to the upgrade to 2.5.1 I was able to go into the search window, search for some values, select a field and get a “QuickValues” widget on top of the search results.
e.g. if I was looking into the DNS logs, I could perform a QuickValues check up on the clients performing the most DNS requests to see if a client was abusing or malfunctioning.
After the upgrade to 2.5.1 the widget does not work. It appears at the top of the results but it is on a constant loading loop. It does not show anything.

However, when I go into the already created dashboards, where some of them already contain QuickValue widgets, there it works ok. The QuickValue widgets added in the past to the dashboards work perfect and appear immediately.
But I cannot do new ones, the loop forever trying to load and they never load.

It cannot be a problem with the fields or mappings in elasticsearch or the dashboards will not work either. Seems to be a problem in Graylog, it is not able to create/show new QuickValue widgets.

Anyone has found a similar issue?

Thanks

did you update elasticsearch also?
If you did, you have to do a recalculate index ranges. Until that the searches can do odd things (like that).

doing the recalculate index range after updates is always a good idea if strange behavior is seen with search and widgest.

Hi Macko and Jan,

yes I tried to recalculate the index ranges, I even close the index, created a new one and deleted the old index then repush the data into Graylog so all was fresh.
But it did not work, the widget in the search for the “Quick Values” is still not working:
Quickvalues_stuck

Widgets added in the past into dashboards, before the update of Graylog, work ok. Also manual searches work ok, and I can get the Quick Values equivalent doing manual searches in elasticsearch via Kibana. There really seems to be a problem with the Quick Values widget after the update.

what is your elasticsearch cluster’s state?

did you have any logs of Graylog, that you have checked for errors?

Without that we can just nod and say - yes it looks like you have a problem.

1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.