# Unable to see logs in stream even though message per second is active

**URL:** <https://community.graylog.org/t/unable-to-see-logs-in-stream-even-though-message-per-second-is-active/24147>\
**Category:** Graylog Central (peer support)\
**Created:** [June 3, 2022, 8:06am UTC](https://community.graylog.org/t/unable-to-see-logs-in-stream-even-though-message-per-second-is-active/24147 "2022-06-03T08:06:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![justinlj](https://avatars.discourse-cdn.com/v4/letter/j/7ab992/32.png) [@justinlj](https://community.graylog.org/u/justinlj)\
**Post date:** [June 3, 2022, 8:06am UTC](https://community.graylog.org/t/unable-to-see-logs-in-stream-even-though-message-per-second-is-active/24147/1 "2022-06-03T08:06:57Z")

</div>

**1. Describe your incident:**  
Even though I am able to see messages flowing into the stream/second, when I click on the stream, it is empty.

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/2/2a01e0bd0c5b03981310554c8539aec452f6f898.png)

**2. Describe your environment:**

- OS Information:

- 3 Glog – glog/mongo/ES​

- 12 ES – 6 glog/ES, 6 ES​

- RHEL 8.3​

- Package Version: Graylog 3.3.16

- Service logs, configurations, and environment variables:

**3. What steps have you already taken to try and solve the problem?**  
Restarted the Graylog + ES nodes but the graph is still blank.

**4. How can the community help?**  
Any idea how else to troubleshoot this?

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [June 3, 2022, 9:47pm UTC](https://community.graylog.org/t/unable-to-see-logs-in-stream-even-though-message-per-second-is-active/24147/2 "2022-06-03T21:47:11Z")

</div>

Hello && Welcome @justinlj

This could be multiple issues why your not see logs. To start off troubleshooting this issue check the Graylog log file. Since your using RHEL it would be `/var/log/graylog-server` perhaps tail -f that file and watch what’s going on. Or restart GL service and watch how GL service is starting up , probably give you a better idea what’s going on.

Normally when logs are not shown this is a direct result of Elasticsearch. You could also check those logs which is located here `/var/log/elasticsearch`

If you see anything that could be a issue, post those logs here by using the markdown `</>` to format those logs and/or configuration files.

Which is my next suggestion, showing configuration files on this setup would be appreciated in helping us, helping you.

Since you have a cluster GL, ES and MongoDb. Checking the cluster health would be another way of finding out what’s going one. Insure Firewall and/or SELinux is not interfering.

To simplify troubleshooting tips, here is a list :

Check the following:

```auto
systemctl status graylog-server
systemctl status elasticsearch
systemctl status mongod
journalctl -xe

```

Elasticsearch Checks:

- Check health of the cluster

```auto
curl -XGET http://127.0.0.1:9200/_cluster/health?pretty

```

- If issue was shown, this show the reason why

```auto
 curl -XGET http://127.0.0.1:9200/_cluster/allocation/explain?pretty

```

- Returns cluster nodes information.

```auto
 curl -XGET http://127.0.0.1:9200/_nodes?pretty=true

```

More can be found here

- [Cluster APIs | Elasticsearch Guide [8.2] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/cluster.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [June 17, 2022, 9:47pm UTC](https://community.graylog.org/t/unable-to-see-logs-in-stream-even-though-message-per-second-is-active/24147/3 "2022-06-17T21:47:16Z")

</div>

Closed on June 17, 2022, 9:47pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.