# Search is empty even elasticsearch has data in index **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [October 23, 2018, 3:33pm UTC](https://community.graylog.org/t/search-is-empty-even-elasticsearch-has-data-in-index/7360 "2018-10-23T15:33:10Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![satishdotpatel](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/satishdotpatel/32/7883_2.png) [@satishdotpatel](https://community.graylog.org/u/satishdotpatel)\ **Post date:** [October 23, 2018, 3:33pm UTC](https://community.graylog.org/t/search-is-empty-even-elasticsearch-has-data-in-index/7360/1 "2018-10-23T15:33:10Z")
I have just setup new graylog and playing with it and found my clients sending logs to graylog but its not showing in search or anywhere, if i query data in elasticsearch i can see all of my data. - I am using UDP 1514 input for Cisco syslog - Gaylog 2.4 - ES - 5.x - MongoDB 3.6 I can see all my logs in following command ``` [root@graylog ~]# curl -H 'Content-Type: application/json' -X GET http://localhost:9200/graylog_1/_search?pretty { "took" : 3, "timed_out" : false, "_shards" : { "total" : 4, "successful" : 4, "skipped" : 0, "failed" : 0 }, "hits" : { "total" : 22, "max_score" : 1.0, "hits" : [ { "_index" : "graylog_1", "_type" : "message", "_id" : "8b987d10-d67e-11e8-bb7b-6c3be5a99590", "_score" : 1.0, "_source" : { "level" : 5, "streams" : [ "000000000000000000000001" ], "source" : "unknown", "message" : "%ETHPORT-5-IF_DOWN_ADMIN_DOWN: Interface Ethernet1/1 is down (Administratively down)", "gl2_source_input" : "5bce8baf370f98103d87fe4a", "sequence_number" : 0, "full_message" : "<181>: 2018 Oct 23 01:56:24 UTC: %ETHPORT-5-IF_DOWN_ADMIN_DOWN: Interface Ethernet1/1 is down (Administratively down)", "gl2_source_node" : "cfa5b46c-2c4a-4904-9905-6e3e8a1386ed", "facility" : "local6", "timestamp" : "2018-10-23 01:56:24.000" } }, { .... .... ``` My Switches using following EST timestamp for logging and i have changed root\_timezone = EST in graylog but still no luck, i have increase my search to 1 year but still no data. Side note: I am running input on 1514 because graylog not allowing me to open port on 514. also my cisco switch default send logs on 514 so i have setup iptables to REDIRECT my all logs from 514 --\> 1514 ( do you think this could be the issue?) ``` iptables -t nat -A PREROUTING -p tcp --dport 514 -j REDIRECT --to 1514 iptables -t nat -A PREROUTING -p udp --dport 514 -j REDIRECT --to 1514 ``` What could be wrong here? ---
**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\ **Post date:** [October 23, 2018, 3:36pm UTC](https://community.graylog.org/t/search-is-empty-even-elasticsearch-has-data-in-index/7360/2 "2018-10-23T15:36:57Z")
Hi @satishdotpatel If you go to the System/Overview tab within the Graylog Web Interface and scroll down, you should see three values for Time. One for the currently logged in user, One for Graylog and another for the Server that Graylog is running on. Are those times the same/what you’re expecting them to be? — EDIT — Are you not able to change the port that your Cisco devices send the syslog messages to? Thanks ---
**Author:** ![satishdotpatel](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/satishdotpatel/32/7883_2.png) [@satishdotpatel](https://community.graylog.org/u/satishdotpatel)\ **Post date:** [October 23, 2018, 3:41pm UTC](https://community.graylog.org/t/search-is-empty-even-elasticsearch-has-data-in-index/7360/3 "2018-10-23T15:41:09Z")
Those time is in EST and that is matching with my Cisco switch time. ![22%20AM](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/4/43aefdff0a6615004c5924feac298bda6e2371d2.png) Yes i can’t change logging port on Cisco switches because Cisco nexus don’t allow you to change destination port, that feature is only for IOS base switches. Is there a way i can force graylog to listen on 514 port that would be awesome! ---
**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\ **Post date:** [October 23, 2018, 3:47pm UTC](https://community.graylog.org/t/search-is-empty-even-elasticsearch-has-data-in-index/7360/4 "2018-10-23T15:47:49Z")
Hi again, So, the time configuration you posted above matches the time on your Cisco switches as well, right? If you run tcpdump filtering on packets destined for Port 1514 or 514 on your graylog server, can you see data coming into the box from your switches? ---
**Author:** ![satishdotpatel](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/satishdotpatel/32/7883_2.png) [@satishdotpatel](https://community.graylog.org/u/satishdotpatel)\ **Post date:** [October 23, 2018, 4:01pm UTC](https://community.graylog.org/t/search-is-empty-even-elasticsearch-has-data-in-index/7360/5 "2018-10-23T16:01:09Z")
Yes timestamp is matching on switches and graylog server (both on EST) Yes they are coming to 514 and 1514 port and they are going in elasticsearch, i can see them as i posted above output you can see cisco syslog messages. I am able to browse all logs using curl command against elasticsearch index so i am 100% sure its working, my Document count is rising too Only graylog not showing anything in search ---
**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\ **Post date:** [October 23, 2018, 4:10pm UTC](https://community.graylog.org/t/search-is-empty-even-elasticsearch-has-data-in-index/7360/6 "2018-10-23T16:10:55Z")
Can you see any recent messages through Elasticsearch? The timestamp of the example you posted in the first message is nearly 2AM ---
**Author:** ![satishdotpatel](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/satishdotpatel/32/7883_2.png) [@satishdotpatel](https://community.graylog.org/u/satishdotpatel)\ **Post date:** [October 23, 2018, 4:25pm UTC](https://community.graylog.org/t/search-is-empty-even-elasticsearch-has-data-in-index/7360/7 "2018-10-23T16:25:57Z")
I think i messed up i was trying to delete all mesg from index graylog\_1 but by mistake deleted index itself. I had two index before graylog\_1 and graylog\_0 and all mesg were going in grayog\_1 but after delete graylog\_1 mesg not going in graylog\_0 How do i get my graylog\_1 index back or is there a good way to re-create index? ---
**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\ **Post date:** [October 23, 2018, 4:33pm UTC](https://community.graylog.org/t/search-is-empty-even-elasticsearch-has-data-in-index/7360/8 "2018-10-23T16:33:04Z")
I’m not too familiar with dealing with the index sets since I’ve never really had to do much with them, thankfully mine have just worked… The [Graylog documentation](http://docs.graylog.org/en/2.4/pages/configuration/index_model.html) may give you some ideas as to what you should do. ---
**Author:** ![satishdotpatel](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/satishdotpatel/32/7883_2.png) [@satishdotpatel](https://community.graylog.org/u/satishdotpatel)\ **Post date:** [October 23, 2018, 4:36pm UTC](https://community.graylog.org/t/search-is-empty-even-elasticsearch-has-data-in-index/7360/9 "2018-10-23T16:36:14Z")
I am seeing this error in graylog server.log ``` 2018-10-23T12:35:12.519-04:00 WARN [Messages] Failed to index message: index= id=<9cc2adf0-d6e1-11e8-9779-6c3be5a99590> error=<{"type":"cluster_block_exception","reason":"blocked by: [FORBIDDEN/8/index write (api)];"}> 2018-10-23T12:35:12.520-04:00 ERROR [Messages] Failed to index [1] messages. Please check the index error log in your web interface for the reason. Error: One or more of the items in the Bulk request failed, check BulkResult.getItems() for more information. 2018-10-23T12:35:13.517-04:00 WARN [Messages] Failed to index message: index= id=<9d5b1d60-d6e1-11e8-9779-6c3be5a99590> error=<{"type":"cluster_block_exception","reason":"blocked by: [FORBIDDEN/8/index write (api)];"}> 2018-10-23T12:35:13.518-04:00 ERROR [Messages] Failed to index [1] messages. Please check the index error log in your web interface for the reason. Error: One or more of the items in the Bulk request failed, check BulkResult.getItems() for more information. ``` ---
**Author:** ![satishdotpatel](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/satishdotpatel/32/7883_2.png) [@satishdotpatel](https://community.graylog.org/u/satishdotpatel)\ **Post date:** [October 23, 2018, 5:14pm UTC](https://community.graylog.org/t/search-is-empty-even-elasticsearch-has-data-in-index/7360/10 "2018-10-23T17:14:48Z")
Finally after rorated index it works!!! damn it!! ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [November 6, 2018, 5:15pm UTC](https://community.graylog.org/t/search-is-empty-even-elasticsearch-has-data-in-index/7360/11 "2018-11-06T17:15:01Z")
Closed on November 6, 2018, 5:15pm UTC This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.