1. Describe your incident:
Hi All ,
I have an strange incident in gralog
Input is in place , i show message has been received on input , but nothing appear in search when i click on show received messages
2. Describe your environment:
OS Information: Ubuntu
Package Version: Graylog 4.2.8
Service logs, configurations, and environment variables:
3. What steps have you already taken to try and solve the problem?
create an another account and see the timezone
Try in absolute with updated every 1sec
4. How can the community help?
Can you help me to shown all message received by graylog
In the second screen shot you showed, the big thing I notice is that you have 103 message inbound and zero outbound. Outbound would be message being delivered to backend storage in Elasticsearch. Also the yellow dot means the entered search criteria has not been executed on.
Does your input have a Stream associated with it… that points to an index created (in Graylog) in Elasticsearch? having messages tied up and not going outbound may point to that…
Thanks for you response.
As you can see below i have now entered and validated search criteria.
About index i have created an index test for try and i can see this index grow when my input is started
Thanks for these all information.
Do you have a stream set up to connect the Input to the Index?
Adding on to @tmacgbay statement.
Couple things you can check.
System/Overview on the Web UI. Insure the Time Configuration match.
Check Elasticsearch/Graylog logs for anything suspicious
Also check your System logs.
root# journalctl -xe
Thanks for all you response.
About stream , i have just the default stream without output configured.Do i need to set an output on stream ?
About time , i have the correct time configuration.
I will see the log and give a return about that. Thanks for this help
Check your graylog file. I had this exact issue and it was a certificate problem. The server.log file showed the issue clear as day
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.