Remove Alert definitions without UI

Graylog Central (peer support)
1

Description of your problem

Graylog (3.1.4) is stuck on loading “Alerts” page, and never display results. This is what i see in server.log

2021-11-09T14:26:50.911Z ERROR [EventProcessorExecutionJob] Event processor <6098728414f7870012df1122> failed to execute: parameters=AggregationEventProcessorParameters{type=aggregation-v1, timerange=AbsoluteRange{type=absolute, from=2021-05-16T22:15:14.587Z, to=2021-05-16T22:20:14.586Z}, streams=[], batchSize=500} (retry in 5000 ms)
java.lang.RuntimeException: IOException encountered while reading from a byte array input stream

Caused by: com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException: Unrecognized field "query_parameters" (class org.graylog.events.processor.aggregation.AutoValue_AggregationEventProcessorConfig$Builder), not marked as ignorable (8 known properties: "streams", "execute_every_ms", "series", "conditions", "type", "search_within_ms", "group_by", "query"])

Is there any way to remove all alert conditions not via UI. or any other way to approach the problem ?

Environmental information

Graylog 3.1.4

Operating system information

  • Ubuntu
  • Containers (Docker)

Package versions

  • Graylog : 3.1.4
  • MongoDB: 4.1
  • Elasticsearch: 6.8.5
2

Hello

Did you check elasticsearch log files to see if anything that would pertain to this issue? if so, could you post that here?

Is the Alert page the only one in loading?
Have you thought about upgrading to 3.3 for bug fixes?

Perhaps there is something in this post they may help.

3

I just went to mongodb and removed problematic event definition that appear in server.log
This solved the problem, page is loading again.

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.