Unable to import content pack

Graylog Central (peer support)
1

We are running Graylog on k8s and locally on docker. I have configured “things” on our k8s env for Graylog, like the dashboard. I’m trying to import the settings/configs to our local dev Graylog, with these steps

  1. Created content pack with both dashboard and streams selected. No parameters.
  2. Downloaded the json
  3. Uploaded the json to local graylog
  4. Hit the install, and I see error 500 on UI

On the Graylog logs I have this:
“org.graylog2.contentpacks.exceptions.ContentPackException: Missing Stream for widget entity”

Tried to understand the json what could be missing, but no luck…
I have exported both (and only these) dashboard and stream. I don’t get what am I missing here.

Thank you in advance!

2

Hello,

Looks like you missing the Stream for one of your widgets.

3

Yup, but how to what am I missing on the import?
On the json file the widget values are:

state.00000179-5a0f-4ecd-8659-cec4fd4f602b.widgets.4.streams.0 string 000000000000000000000001

An other “streams” on the json have the same value, like:

search.queries.0.search_types.4.streams.0 string 000000000000000000000001

What is this value?

I’m using default stream “all messages” where I’m exporting, what actions do I need to take on export?

4

Hello,
Are both graylog servers the same version?
All your Widgets from the dashboard/s are using the default stream (All Messages) when you made your content pack?
Have you tried to make one content pack for one dashboard?
Maybe test each dashboard separately.

5

Thank you for these!
I had different versions of graylog 3.1.x and 3.1.1. Updated both to version 3.1.13. But the dashboard was created in the old version.

Created again the dashboard on new version, and uploading/installation for this content pack now works fine.

BUT, as I try add (or just make content pack of these) an event with notification. I hit the stream error again:

Caused by: org.graylog2.contentpacks.exceptions.ContentPackException: Missing Stream for event definition

Stream on event is “All messages”.
As I try to add the stream “All messages” to the content pack, it is not listed, why?

I was assuming as the event uses “all messages” stream that would work, even without exporting that into the content pack, as it is default “all streams”, or em I missing something here?

Also, as I was googling about the issue, I game up with this post: Cannot install content pack with EventDefinition that uses Default Stream · Issue #7212 · Graylog2/graylog2-server · GitHub
Could this be a bug?

EDIT: removed the stream from the event “filter & aggregation” section, and then I was able to install. I will do some more testing & research, if I can came up with something resonable…

6

Hello,
Every Graylog Server version I’ve installed or upgraded to always had a default stream “All messages” so when I created dashboard/s or content packs I never had to configure “All messages” stream for “filter & aggregation” section. Here is one example of mine.

image
image1857×690 65.8 KB

If I had a unique stream then yeah I would place it in “Streams (Optional)” section. I believe by default Event Definition uses the default streams. Maybe someone here has a better insight why you can’t use "All Message’ stream.
Hope that helps

7

Thank you so much for the details! :smiling_face_with_three_hearts:

And, I was able to upload and install after recreating the content packs after upgrading, there might be some issue with migrating the content packs. Should not have been in such a rush.

1 Like
8

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.