I recently rebuilt our Graylog server and separated Graylog from Elasticsearch. This was in an effort to spread out resources. Everything was working good until I checked this morning and I am no longer able to get to the Web GUI. It was working about a week ago and I am not sure what happened. I am also very unsure on how to diagnose the Web GUI.
The error I am getting is
We are experiencing problems connecting to the Graylog server running on http://servername:9000/api/ . Please verify that the server is healthy and working correctly.
Error message
Request has been terminated Possible causes: the network is offline, Origin is not allowed by Access->Control-Allow-Origin, the page is being unloaded, etc.
As far as I can tell, all network related settings are functioning properly.
Server Config
Graylog Server
RHEL 8.4
Graylog 4.0.8
8 CPUs
8 GB Memory
ElasticSearch Server
RHEL 8.4
ElasticSearch 7.12.0
4 CPUs
16 GBs Memory
Graylog Config
is_master = true
node_id_file = /etc/graylog/server/node-id
password_secret =
root_password_sha2 =
root_timezone = US/Central
bin_dir = /usr/share/graylog-server/bin
data_dir = /var/lib/graylog-server
plugin_dir = /usr/share/graylog-server/plugin
http_bind_address = 10.3.xxx.xxx:9000
http_bind_address = servername:9000
elasticsearch_hosts = http://10.3.xxx.xxx:9200
rotation_strategy = count
elasticsearch_max_docs_per_index = 20000000
elasticsearch_max_number_of_indices = 20
retention_strategy = delete
elasticsearch_shards = 4
elasticsearch_replicas = 0
elasticsearch_index_prefix = graylog
allow_leading_wildcard_searches = false
allow_highlighting = false
elasticsearch_analyzer = standard
output_batch_size = 5000
output_flush_interval = 1
output_fault_count_threshold = 5
output_fault_penalty_seconds = 30
processbuffer_processors = 4
outputbuffer_processors = 4
processor_wait_strategy = blocking
ring_size = 65536
inputbuffer_ring_size = 65536
inputbuffer_processors = 2
inputbuffer_wait_strategy = blocking
message_journal_enabled = true
message_journal_dir = /var/lib/graylog-server/journal
lb_recognition_period_seconds = 3
mongodb_uri = mongodb://localhost/graylog
mongodb_max_connections = 1000
mongodb_threads_allowed_to_block_multiplier = 5
proxied_requests_thread_pool_size = 32
Elasticsearch Config
cluster.name: graylog
node.name: node-1
path.data: /home/elasticsearch/data
path.logs: /var/log/elasticsearch
network.host: 10.3.xxx.xxx
cluster.initial_master_nodes: [“node-1”]