# Unable to get the logs in graylog gui

**URL:** <https://community.graylog.org/t/unable-to-get-the-logs-in-graylog-gui/22467>\
**Category:** Graylog Central (peer support)\
**Created:** [January 25, 2022, 12:57pm UTC](https://community.graylog.org/t/unable-to-get-the-logs-in-graylog-gui/22467 "2022-01-25T12:57:12Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![linuxuser](https://avatars.discourse-cdn.com/v4/letter/l/f475e1/32.png) [@linuxuser](https://community.graylog.org/u/linuxuser)\
**Post date:** [January 25, 2022, 12:57pm UTC](https://community.graylog.org/t/unable-to-get-the-logs-in-graylog-gui/22467/1 "2022-01-25T12:57:12Z")

</div>

**1. Describe your incident:**  
I am able to get the logs from all devices that are added to graylog but unable to see the logs from a firewall to my graylog gui although the traffic from that device is visible in the cli.

 ![WhatsApp Image 2022-01-25 at 17.37.26](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/0/0da91e7caf07c370df8fe1f247de333383d3f017.jpeg)  
And I get this in /var/log/elasticsearch/graylog.log file.  
– cat graylog.log |grep ‘172.20.23.148’

`[2022-01-25T17:32:59,998][DEBUG][o.e.a.b.TransportShardBulkAction] [DC-ELASTIC-01] [graylog_3][1] failed to execute bulk item (index) index {[graylog_deflector][message][ad330c80-7dd6-11ec-923d-005056a5b9cb], source[{"date":"2022-01-25,time=17:32:58,devname=","devid":"FGT1KD5818800570","msg":"Delete 2 old report files","tz":"+0530","gl2_remote_ip":"172.20.23.148","gl2_remote_port":9223,"eventtime":"1643112179228197507,tz=","source":"172.20.23.148","type":"event","gl2_source_input":"5ee4aa493751891269f56286","subtype":"system","devname":"DC-DEL-EFW-01","gl2_source_node":"a0c03946-aab2-44b2-a932-ecb6889d495d","timestamp":"2022-01-25 12:02:32.391","level":6,"streams":["000000000000000000000001"],"message":"date=2022-01-25,time=17:32:58,devname=\"DC-DEL-EFW-01\",devid=\"FGT1KD5818800570\",eventtime=1643112179228197507,tz=\"+0530\",logid=\"0100020027\",type=\"event\",subtype=\"system\",level=\"information\",vd=\"root\",logdesc=\"Outdated report files deleted\",msg=\"Delete 2 old report files\"","vd":"root","logdesc":"Outdated report files deleted","20201217":"2","full_message":"<190>date=2022-01-25,time=17:32:58,devname=\"DC-DEL-EFW-01\",devid=\"FGT1KD5818800570\",eventtime=1643112179228197507,tz=\"+0530\",logid=\"0100020027\",type=\"event\",subtype=\"system\",level=\"information\",vd=\"root\",logdesc=\"Outdated report files deleted\",msg=\"Delete 2 old report files\"","logid":"0100020027","facility":"local7"}]}`

**2. Describe your environment:**

- OS Information: Ubuntu 18.04

- Package Version: Graylog 3.0.2 and Elasticsearch 6.8

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [January 25, 2022, 11:45pm UTC](https://community.graylog.org/t/unable-to-get-the-logs-in-graylog-gui/22467/2 "2022-01-25T23:45:12Z")

</div>

Hello

What type of input are you using for your firewall logs?

Could you explain in greater detail of your configuration to ingest firewall logs.

Thanks

---

<div class="post-metadata">

**Author:** ![linuxuser](https://avatars.discourse-cdn.com/v4/letter/l/f475e1/32.png) [@linuxuser](https://community.graylog.org/u/linuxuser)\
**Post date:** [January 27, 2022, 5:39am UTC](https://community.graylog.org/t/unable-to-get-the-logs-in-graylog-gui/22467/3 "2022-01-27T05:39:12Z")

</div>

Thanks for your response.  
We are using syslog udp input on port 1514 to collect all message logs. And also created a gelf input on same port.

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [January 27, 2022, 5:40am UTC](https://community.graylog.org/t/unable-to-get-the-logs-in-graylog-gui/22467/4 "2022-01-27T05:40:56Z")

</div>

Troubleshooting 101.

Try using **RawPlainText UDP** for your firewall logs see if that works.  
EDIT: If you can keep the default port on that to 5555

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [February 10, 2022, 5:41am UTC](https://community.graylog.org/t/unable-to-get-the-logs-in-graylog-gui/22467/5 "2022-02-10T05:41:20Z")

</div>

Closed on February 10, 2022, 5:41am UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.