Ubuntu install tutorial: connection reset

Hey folks!

Just setup a new vagrant machine to do the ubuntu installation tutorial:

  • ubuntu 16.04
  • 4 gb RAM

All settings default, except the ones mentioned in the tutorial.
All 3 services (mongo, elastic, graylog) are running.

I’m able to access the virtual machine’s apache via browser:
But I’m not able to access the graylog interface on

I changed graylog’s port (for debugging) to 9009, because I’ve set the VM’s fpm pool as well as fastcgi listening to


  • elasticsearch[8223]: warning: Falling back to java on path. This behavior is deprecated. Specify JAVA_HOME
  • puppet-agent[1281]: Could not request certificate: Failed to open TCP connection to puppet:8140 (getaddrinfo: Temporary failure in name resolution)

graylog server.log

  • ERROR [IndexFieldTypePollerPeriodical] Couldn’t update field types for index set <Default index set
  • Caused by: org.apache.http.conn.HttpHostConnectException: Connect to [/] failed: Connection refused (Connection refused)
  • ERROR [AuditLogger] Unable to write audit log entry because there is no valid license.
  • ERROR [Cluster] Couldn’t read cluster health for indices [graylog_, gl-events_, gl-system-events_*] (Could not connect to
  • Why 9200? What’s the problem? (Port 9200 is elasticsearch…)

You should go trough this

Okay, but all settings are default and good to go (I think); it’s a clean small setup, just 1 machine, 1 local elasticsearch node, 1 local graylog server (like the tutorial).

I don’t have a clue what’s wrong…

he @the-flo

without any shared configurations, it is hard to tell what the problem is.

But Graylog needs to connect to Elasticsearch, because that is holding the DATA. Means that is the place where Graylog ingest the messages after processing. If that is not listening to on the default port 9200.

For the connection to Graylog from the outside you should check the http_* settings and read (and not only guess) what they are for.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.