Unable to see logs in stream even though message per second is active

1. Describe your incident:
Even though I am able to see messages flowing into the stream/second, when I click on the stream, it is empty.

2. Describe your environment:

  • OS Information:

  • 3 Glog – glog/mongo/ES​

  • 12 ES – 6 glog/ES, 6 ES​

  • RHEL 8.3​

  • Package Version: Graylog 3.3.16

  • Service logs, configurations, and environment variables:

3. What steps have you already taken to try and solve the problem?
Restarted the Graylog + ES nodes but the graph is still blank.

4. How can the community help?
Any idea how else to troubleshoot this?

Hello && Welcome @justinlj

This could be multiple issues why your not see logs. To start off troubleshooting this issue check the Graylog log file. Since your using RHEL it would be /var/log/graylog-server perhaps tail -f that file and watch what’s going on. Or restart GL service and watch how GL service is starting up , probably give you a better idea what’s going on.

Normally when logs are not shown this is a direct result of Elasticsearch. You could also check those logs which is located here /var/log/elasticsearch

If you see anything that could be a issue, post those logs here by using the markdown </> to format those logs and/or configuration files.

Which is my next suggestion, showing configuration files on this setup would be appreciated in helping us, helping you.

Since you have a cluster GL, ES and MongoDb. Checking the cluster health would be another way of finding out what’s going one. Insure Firewall and/or SELinux is not interfering.

To simplify troubleshooting tips, here is a list :

Check the following:

systemctl status graylog-server
systemctl status elasticsearch
systemctl status mongod
journalctl -xe

Elasticsearch Checks:

  • Check health of the cluster
curl  -XGET
  • If issue was shown, this show the reason why
 curl  -XGET
  • Returns cluster nodes information.
 curl  -XGET

More can be found here

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.