Ubuntu 16.04 Rsyslog syslogs to Graylog 2.4 not showing in GUI

[Magneton (Jake Smith)]

Dear All,

I have a ubuntu 16.04 server at 10.0.1.247 configured to send syslogs to a Graylog install at 10.0.1.177

The rsyslog on the ubuntu machine is configured as shown below

We can see the logs being received.

Our input is configured as shown below.

If we look at the metric for the input, we can see messages as such

However, when we check the " show received messages" button we see no messages even with all messages time frame set.

The logs at /var/log/graylog-server/server.loog show nothing abnormal.

Any help on what is happening to the messages?

Kind Regards

Jake Smith

[jan (Jan Doberstein)]

If you select a timeframe from the future - 1.1.2018 to 31.12.2018 did you see the messages?

If you check the time settings on the sender and graylog is that the same timezone?

[Magneton (Jake Smith)]

Hi Jan,

System times are good

Time search in future obviously shows nothing

Any further suggestions?

Kind Regards

Jake

[jan (Jan Doberstein)]

did you checked the system > indices page if something is saved in elasticsearch?

What timerange does the indices overview gives you? Maybe you just need to recalculcate the index range to fix that.

[Magneton (Jake Smith)]

Hi Jan,

I did the recalculate index range under the maintenance tab on the default index and it resolved the issue.

Can you explain or point me to some resources so that I can understand how recalculating the index solves the issue. How do elasticsearch indexes lose their time range?

Cheers

Jake Smith

[jan (Jan Doberstein)]

Graylog uses Elasticsearch via the REST API - it can happen that it is not able to hold the data about the range of one index for multiple reasons.

The best indicator is when the index range is written from 1.1.1970 to some day in the future. Then Graylog does not know what timerange can be found in what index.

We did not cover the multiple reasons and rare conditions in the documentation yet.