Search Not Showing Results. Index Range Calculated 18 Days Ago

Hi Everyone.

I am fairly new to Graylog and how it works. I’ve been searching in the forums and Google for someone else having similar issue but it seems I’m stuck. About 18 days ago I installed Graylog on VMware from the provided OVA. Today I decide to start configuring logs. I have logs coming into Graylog from Windows server using NXLog but when I click the “search” page or try to view the logs coming in from the Input, it goes to Search page and is “forever loading” and it won’t show me anything.

First thing is I check System > Overview and everything looks healthy. There are no errors on Elasticsearch or Indexer. All the time configurations match.

Some other posts refer to recalculating the index ranges to have them show up properly in Search. For example, one user did not have the index ranges calculated at all and saw blank data in the Search page. My issue is that I’m not getting Search to load up at all, it just spins with “Loading” in the top right corner of a gray page.

When I check my Default index set, I do see logs coming into it. I manually “recalculate index ranges” and it says it completed recalculating 1 index range in x milliseconds. I’m still not seeing anything under Search, and right under the index it says “Range re-calculated 18 days ago in 0ms.” which is about the time I had installed the server. I have updated and rebooted server several times.

So what I did is manually rotate the active index so now it shows Graylog_1 as the active index. Now both Graylog_0 and Graylog_1 show last updated about 1 minute ago. Same symptom with Search page just “loading”. Not sure what I might be doing wrong or if I’m missing an out of box config. If anyone wants log files please kindly point to the directory of the log and I can tail it for you. Thanks.

I’ve gone ahead, redownload the latest 3.2.3 OVA for Graylog and deployed it. I’m not experiencing the same issue with Search not loading. Leading me to believe something got messed up on my old appliance or something during the upgrade process to 3.2.3. broke the search page.

OP can kill this thread. I deleted the old appliance and am rolling forward with the new deployment that is working properly. Chalking it up to a failed upgrade. I did not have it configured at that point so it’s not a big loss.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.