# Show Received Messages from Input

**URL:** <https://community.graylog.org/t/show-received-messages-from-input/5709>\
**Category:** Graylog Central (peer support)\
**Created:** [June 22, 2018, 11:44am UTC](https://community.graylog.org/t/show-received-messages-from-input/5709 "2018-06-22T11:44:11Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![bmogadime](https://avatars.discourse-cdn.com/v4/letter/b/b19c9b/32.png) [@bmogadime](https://community.graylog.org/u/bmogadime)\
**Post date:** [June 22, 2018, 11:44am UTC](https://community.graylog.org/t/show-received-messages-from-input/5709/1 "2018-06-22T11:44:11Z")

</div>

Dear all, when I click on show recived messages the page just keep on loading. there is no errors on the log file. Messages are coming through rsyslog onto port 5140 and I can see activities on In 90 / Out 90 msg/s those numbers changes however when I click on Input / then s show received messages from the UDP node it keeps on loading and loading without retrieving anything similar is for TCP node. Please help.

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [June 22, 2018, 12:47pm UTC](https://community.graylog.org/t/show-received-messages-from-input/5709/2 "2018-06-22T12:47:58Z")

</div>

If your Elasticsearch up and running?

Did you have the same if you just click the search tab?

---

<div class="post-metadata">

**Author:** ![bmogadime](https://avatars.discourse-cdn.com/v4/letter/b/b19c9b/32.png) [@bmogadime](https://community.graylog.org/u/bmogadime)\
**Post date:** [June 25, 2018, 5:44am UTC](https://community.graylog.org/t/show-received-messages-from-input/5709/3 "2018-06-25T05:44:40Z")

</div>

Hi Jan,

Yes elasticsearch is running and it is GREEN, when I click on search tab I don’t get the same problem it’s just that it doesn’t find things that I want to search.

Regards  
Brian

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [June 25, 2018, 8:46am UTC](https://community.graylog.org/t/show-received-messages-from-input/5709/4 "2018-06-25T08:46:35Z")

</div>

when you look into “all messages” did you find anything?

---

<div class="post-metadata">

**Author:** ![bmogadime](https://avatars.discourse-cdn.com/v4/letter/b/b19c9b/32.png) [@bmogadime](https://community.graylog.org/u/bmogadime)\
**Post date:** [June 25, 2018, 8:55am UTC](https://community.graylog.org/t/show-received-messages-from-input/5709/5 "2018-06-25T08:55:34Z")

</div>

> [@jan](#):
>
> all messages

Hi Jan, still nothing please check the attachment

 ![graylong_search](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/7/70e5632744621d83f5d804add52c45f3e2a56df5.PNG)

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [June 25, 2018, 8:57am UTC](https://community.graylog.org/t/show-received-messages-from-input/5709/6 "2018-06-25T08:57:19Z")

</div>

and if you remove “java” and just display all messages?

---

<div class="post-metadata">

**Author:** ![bmogadime](https://avatars.discourse-cdn.com/v4/letter/b/b19c9b/32.png) [@bmogadime](https://community.graylog.org/u/bmogadime)\
**Post date:** [June 25, 2018, 8:58am UTC](https://community.graylog.org/t/show-received-messages-from-input/5709/7 "2018-06-25T08:58:59Z")

</div>

Hi Jan,

check the output screen

 ![graylong_search_without_javastring](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/d/d46051784f5d17d05ecc85c51378e871aa1d66b2.PNG)

---

<div class="post-metadata">

**Author:** ![bmogadime](https://avatars.discourse-cdn.com/v4/letter/b/b19c9b/32.png) [@bmogadime](https://community.graylog.org/u/bmogadime)\
**Post date:** [June 27, 2018, 8:50am UTC](https://community.graylog.org/t/show-received-messages-from-input/5709/8 "2018-06-27T08:50:20Z")

</div>

Can it be that messages are not being recorded hence why I see activity but no messages when I search?

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [June 27, 2018, 8:57am UTC](https://community.graylog.org/t/show-received-messages-from-input/5709/9 "2018-06-27T08:57:15Z")

</div>

hard to tell - but did you checked when you select a specific date from today to some day in future and check if you find message then?

What is the amount of messages you see in `system > indices` ?

---

<div class="post-metadata">

**Author:** ![bmogadime](https://avatars.discourse-cdn.com/v4/letter/b/b19c9b/32.png) [@bmogadime](https://community.graylog.org/u/bmogadime)\
**Post date:** [June 27, 2018, 10:47am UTC](https://community.graylog.org/t/show-received-messages-from-input/5709/10 "2018-06-27T10:47:03Z")

</div>

Hi Jan,

amount of messages is Total: 1 index, 6,052,502 documents, 2.2GB.  
if you don’t mind I can share teamviewer session with you for just 15 minutes to see if you can’t notice something odd

Regards  
Brian

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [June 27, 2018, 11:26am UTC](https://community.graylog.org/t/show-received-messages-from-input/5709/11 "2018-06-27T11:26:44Z")

</div>

He Brian,

so you have logs in the system - but maybe the time of the events is in the future. You would need to play with the dates you query. `All messages` searches from `now` into the past and not in the future.

If you want to have exclusive help, you should contact Sales for professional service ( [https://www.graylog.org/contact-sales](https://www.graylog.org/contact-sales) ). But this is the community board where help is given on a volunteer level.

---

<div class="post-metadata">

**Author:** ![bmogadime](https://avatars.discourse-cdn.com/v4/letter/b/b19c9b/32.png) [@bmogadime](https://community.graylog.org/u/bmogadime)\
**Post date:** [June 27, 2018, 11:45am UTC](https://community.graylog.org/t/show-received-messages-from-input/5709/12 "2018-06-27T11:45:34Z")

</div>

Hi Jan,

I understand, this variable root\_timezone = UTC could it be the problem since the country that I am at is GMT+2?

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [June 27, 2018, 12:44pm UTC](https://community.graylog.org/t/show-received-messages-from-input/5709/13 "2018-06-27T12:44:08Z")

</div>

please read the comments above the setting

> <https://github.com/Graylog2/graylog2-server/blob/2.4/misc/graylog.conf#L72-L74>

Internal Graylog is working always with UTC, this setting is only how/what the root user uses as timezone.

---

<div class="post-metadata">

**Author:** ![bmogadime](https://avatars.discourse-cdn.com/v4/letter/b/b19c9b/32.png) [@bmogadime](https://community.graylog.org/u/bmogadime)\
**Post date:** [June 27, 2018, 6:00pm UTC](https://community.graylog.org/t/show-received-messages-from-input/5709/14 "2018-06-27T18:00:30Z")

</div>

Hi Jan, I am running Centos 7.5 x86\_64 as the OS installed ElasticSearch 5.6.3 with MongoDB 3.6.5 and GrayLog Server 2.4.5 are these okay to operate?. If you have compatibility matrix kindly share with me because in a case like mine I suspect it is compatibility issue.

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [June 27, 2018, 6:58pm UTC](https://community.graylog.org/t/show-received-messages-from-input/5709/15 "2018-06-27T18:58:40Z")

</div>

you can find the requested information in the documentation [http://docs.graylog.org/en/2.4/pages/installation/operating\_system\_packages.html](http://docs.graylog.org/en/2.4/pages/installation/operating_system_packages.html)

You have the data in your Elasticsearch - but I guess that the time is your problem.

---

<div class="post-metadata">

**Author:** ![bmogadime](https://avatars.discourse-cdn.com/v4/letter/b/b19c9b/32.png) [@bmogadime](https://community.graylog.org/u/bmogadime)\
**Post date:** [June 28, 2018, 6:53am UTC](https://community.graylog.org/t/show-received-messages-from-input/5709/16 "2018-06-28T06:53:44Z")

</div>

Hi Jan,

If you were in my case what would you do to resolve this issue?

Regards  
Brian

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [June 28, 2018, 7:57am UTC](https://community.graylog.org/t/show-received-messages-from-input/5709/17 "2018-06-28T07:57:00Z")

</div>

- `recalculate index set` ( [http://docs.graylog.org/en/2.4/pages/configuration/index\_model.html#keeping-the-index-ranges-in-sync](http://docs.graylog.org/en/2.4/pages/configuration/index_model.html#keeping-the-index-ranges-in-sync) )  
you can do that in the UI too - on the maintenance tab
- check the elasticsearch content via REST API
- play with the search time choose absolute time. From some years in the past to some years in the future
- check the time on the sender if that fits the Graylog server time.

---

<div class="post-metadata">

**Author:** ![bmogadime](https://avatars.discourse-cdn.com/v4/letter/b/b19c9b/32.png) [@bmogadime](https://community.graylog.org/u/bmogadime)\
**Post date:** [June 28, 2018, 5:23pm UTC](https://community.graylog.org/t/show-received-messages-from-input/5709/18 "2018-06-28T17:23:11Z")

</div>

Thanks Jan, now I am able to see messages after following that link to recalculate index set.  
Last question I have, if I tar the /var/lib/elasticsearch and import it on another server that runs graylog-server would that be enough since elasticsearch saves messages and Mongo only stores metadb and configs?

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [June 29, 2018, 7:05am UTC](https://community.graylog.org/t/show-received-messages-from-input/5709/19 "2018-06-29T07:05:24Z")

</div>

> Last question I have, if I tar the /var/lib/elasticsearch and import it on another server that runs graylog-server would that be enough since elasticsearch saves messages and Mongo only stores metadb and configs?

what is your goal?

In general I would not advice to do this - taking the database dir from one server copy it over to another - unless you know exactly what you do and when todo.

---

<div class="post-metadata">

**Author:** ![bmogadime](https://avatars.discourse-cdn.com/v4/letter/b/b19c9b/32.png) [@bmogadime](https://community.graylog.org/u/bmogadime)\
**Post date:** [June 29, 2018, 11:55am UTC](https://community.graylog.org/t/show-received-messages-from-input/5709/20 "2018-06-29T11:55:08Z")

</div>

Thanks a lot for all your effort to assist me, now my graylog is functioning properly.

Really appreciate it. 🙂

[Next page](https://community.graylog.org/t/show-received-messages-from-input/5709.md?page=2)
