Troubleshooting Log Ingestion: Syslog and Windows Event Logs (Winlogbeat/Sidecar) not appearing in Search

Graylog Central (peer support)
1

Hi Graylog Community Team,

I am experiencing an issue where my Graylog server is not successfully ingesting or displaying forwarded logs. I am currently trying to set up two parallel ingestion streams: Syslog for network devices and Windows Event Logs via Winlogbeat and the Graylog Sidecar.

Environment Details:

  • OS: Ubuntu 22.04.5 LTS

  • Graylog Version: 4.3.15

  • Elasticsearch: 6.8.23

  • MongoDB: 4.4.30

Current Symptoms: Neither the Syslog data nor the Windows Event Logs are populating in the Search interface. The Windows Sidecar service is installed and running, and the Syslog forwarders are active, but the data is either being dropped or not correctly parsed by the inputs.

Troubleshooting Steps Already Completed:

  1. Service Bindings: Confirmed via ss -lptn that the web interface is successfully bound to 0.0.0.0:9000 and Elasticsearch is correctly restricted to 127.0.0.1.

  2. Input Configuration: Created global inputs in the UI (Beats on port 5044 and Syslog TCP/UDP). The inputs show a “RUNNING” state.

  3. Firewall: Verified that the specific ingestion ports (5044, 514/1514) are open through UFW on the Ubuntu host.

  4. Time Synchronization: Installed and configured chrony. Verified via chronyc tracking that the system time is perfectly synced (Leap status: Normal) with zero significant offset, so logs are not being dropped due to future/past timestamp rejections.

  5. Sidecar Configuration: The Windows Sidecar is using the correct API token and pointing to the /api endpoint.

Could you please advise on the best way to trace these packets once they hit the Ubuntu server to determine if the blockage is happening at the Beats/Syslog input layer, or if Elasticsearch is rejecting the indices?

Thank you,

Ahnaf Tahmeed

2

On the input page do you see any traffic being reported on each input, connections etc?

3

yes only 6kib but i cannot see in search or in dashboard

4

You should see way way more than that, so the problem is the data getting to your graylog in the first place.

Are you sure the syslog is udp vs tcp and that you have used the correct input type to match?

Does your sidecard winlogbeat configuration point to your graylog server on the right address?