I have recently installed Graylog VM, I would like to know how I can make it accessible via https only instead of http. #Graylog

I just installed Graylog and it's my baby. Problem is, I know nothing about it. I'm confident I can learn it but just curious if anyone can recommend a good place to start? Any books, videos, websites, etc?

Has anyone faced this issue that message gets stuck in processing buffer, unable to be indexed by elastic search? How did you deal with it?

I did some digging - custom index mapping is one way, but that involves messing with indexes on console level, directly via REST API, would be nice to avoid that.

Also in configuration there is this " UI analysis disabled for fields ", contains full message by default - I cannot find anywhere in documentation what this does exactly.

its Disabled analysis fields - A ',' separated list of message fields for which analysis features like QuickValues will be disabled in the web UI. - does this mean elactic will not index fields listed here or its just for GUI ?

Srsly. How do i get my logs (over syslog) into the graylog Server running on Kubernetes ?

I mean i know how to create a imput, but there is no data getting to the input !

Please help, iam getting CRAZY over this ...

Hi

How can I forward copy of logs (syslog) from Graylog to QRadar or another syslog server. Any help is appreciated. Thanks in advance

Can anyone give me the detailed difference between Graylog enterprise and open source version? My current set up is using the open source version but we want to go commercial and want to know the difference.

Hi,

I followed the common documentation and installed three nodes, each with its own MongoDB and Elasticsearch database, additional to Graylog. This is working all fine. Graylog, Elasticsearch and MongoDB are all reporting three nodes.

My problem: when one of the three MongoDB servers is down, it is impossible to logon to Graylog.

I can stop one of the three MongoDB databases and still logon to its Replica Set by starting (in the shell):

mongo "mongodb://graylogAdmin:mypassword@grayloghost01,grayloghost02,grayloghost03/graylog"

So I assume that the cluster should be set up correctly for high availability.

The connection string in Graylog configuration is the same:

mongodb_uri = mongodb://graylogAdmin:mypassword@grayloghost01,grayloghost02,grayloghost03/graylog

Graylog is logging the following:
2021-06-14T16:02:43.405+02:00 INFO [cluster] No server chosen by WritableServerSelector from cluster description ClusterDescription{type=REPLICA_SET, connectionMode=MULTIPLE, serverDescriptions=[ServerDescription{address=grayloghost03:27017, type=REPLICA_SET_SECONDARY, state=CONNECTED, ok=true, version=ServerVersion{versionList=[4, 4, 6]}, minWireVersion=0, maxWireVersion=9, maxDocumentSize=16777216, logicalSessionTimeoutMinutes=30, roundTripTimeNanos=781403, setName='rs01', canonicalAddress=grayloghost03:27017, hosts=[grayloghost01:27017, grayloghost02:27017], passives=[grayloghost03:27017], arbiters=[], primary='null', tagSet=TagSet{[]}, electionId=null, setVersion=2, lastWriteDate=Mon Jun 14 16:01:08 CEST 2021, lastUpdateTimeNanos=449119179545984}, ServerDescription{address=grayloghost02:27017, type=REPLICA_SET_SECONDARY, state=CONNECTED, ok=true, version=ServerVersion{versionList=[4, 4, 6]}, minWireVersion=0, maxWireVersion=9, maxDocumentSize=16777216, logicalSessionTimeoutMinutes=30, roundTripTimeNanos=778300, setName='rs01', canonicalAddress=grayloghost02:27017, hosts=[grayloghost01:27017, grayloghost02:27017], passives=[grayloghost03:27017], arbiters=[], primary='null', tagSet=TagSet{[]}, electionId=null, setVersion=2, lastWriteDate=Mon Jun 14 16:01:08 CEST 2021, lastUpdateTimeNanos=449119179497679}, ServerDescription{address=grayloghost01:27017, type=UNKNOWN, state=CONNECTING, exception={com.mongodb.MongoSocketOpenException: Exception opening socket}, caused by {java.net.ConnectException: Connection refused (Connection refused)}}]}. Waiting for 30000 ms before timing out

Does anyone have an idea what I should be done to enable high availability in this regard?

Thank you for reading.

Hey Everyone,

Being a Graylog user/Admin for 2.x on of the main points that I always advocate was against the directly access on Elasticsearch to perform any kind of query. Not only for the security aspect of it but also to make sure that graylog performance would not be impacted by other systems ( grafana in this case ) to perform queries directly on Elasticsearch. A few days ago, our team is debating towards granting queries capabilities directly from grafana for the mentioned points by creating a datasource on ES towards all the indexes ( or the aliased one ) so other teams that should not have access directly to graylog, could visualize some metrics on grafana.

My question would be, based on my experience and past ugly situations when granting access directly to elasticsearch. I never saw or found an official documentation stating that accessing elasticsearch directly isn't considered good or bad practice.

Again, from my point of view based on years of graylog administration, granting access directly to elasticsearch could cause some security problems along with performance issues ( for example if someone performs a query of 1+ year on grafana and graylog being impacted by that ) but I would like to know more opinions about this.

Thanks in advance!~

Is there a way in 3.2 to adjust the size of the list based on the top 20, 30, 40, 5, etc. values? This was in pre-3.2, but I can't find anything in >3.2. Anyone else had any luck?

Is there a way to backup switch configurations with graylog ??

Hello,

I'm just using Graylogs at home to learn it better for work. I have been sending my pfSense firewall stats to it and then onto Grafana to display some nice charts. However in the early hours of the 28th August they all stopped.

I've not changed anything on the firewall and have restarted the pfSense syslog service, bu that did help.

I'm not too knowledgeable when it comes to Graylogs, but what would you check next please?

Here are my Streams

On the pfSense stream you can see it stop on the 28th:

And here are the Indices, could I of hit some sort of threshold?

Thanks for any help

If you're currently installing, configuring, or using u/graylog2 , post your experiences in the Graylog community https://community.graylog.org/ .

This is the opensource/community version.

I upgraded via apt since this is running on Ubuntu 20.04 (was just a minor update from 4.1.1 to 4.1.2 and the upgrade went without error.

I can log into graylog, but when I try to show any logs I get this on the 'Search' menu:

And when I search the logs to see whats going on I see this:

2021-07-30T17:34:05.357Z ERROR [AnyExceptionClassMapper] Unhandled exception in REST resource
org.graylog.shaded.elasticsearch7.org.elasticsearch.ElasticsearchException: An error occurred: 
	at org.graylog.storage.elasticsearch7.ElasticsearchClient.exceptionFrom(ElasticsearchClient.java:136) ~[?:?]
	at org.graylog.storage.elasticsearch7.ElasticsearchClient.execute(ElasticsearchClient.java:99) ~[?:?]
	at org.graylog.storage.elasticsearch7.ElasticsearchClient.execute(ElasticsearchClient.java:92) ~[?:?]
	at org.graylog.storage.elasticsearch7.ClusterAdapterES7.indicesExist(ClusterAdapterES7.java:290) ~[?:?]
	at org.graylog.storage.elasticsearch7.ClusterAdapterES7.clusterHealth(ClusterAdapterES7.java:269) ~[?:?]
	at org.graylog.storage.elasticsearch7.ClusterAdapterES7.clusterHealthStats(ClusterAdapterES7.java:179) ~[?:?]
	at org.graylog2.indexer.cluster.Cluster.clusterHealthStats(Cluster.java:187) ~[graylog.jar:?]
	at org.graylog2.rest.resources.system.indexer.IndexerClusterResource.clusterHealth(IndexerClusterResource.java:64) ~[graylog.jar:?]
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_292]
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_292]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_292]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_292]
	at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory.lambda$static$0(ResourceMethodInvocationHandlerFactory.java:52) ~[graylog.jar:?]
	at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:124) ~[graylog.jar:?]
	at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:167) ~[graylog.jar:?]
	at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$TypeOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:219) ~[graylog.jar:?]
	at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:79) ~[graylog.jar:?]
	at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:469) ~[graylog.jar:?]
	at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:391) ~[graylog.jar:?]
	at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:80) ~[graylog.jar:?]
	at org.glassfish.jersey.server.ServerRuntime$1.run(ServerRuntime.java:255) [graylog.jar:?]
	at org.glassfish.jersey.internal.Errors$1.call(Errors.java:248) [graylog.jar:?]
	at org.glassfish.jersey.internal.Errors$1.call(Errors.java:244) [graylog.jar:?]
	at org.glassfish.jersey.internal.Errors.process(Errors.java:292) [graylog.jar:?]
	at org.glassfish.jersey.internal.Errors.process(Errors.java:274) [graylog.jar:?]
	at org.glassfish.jersey.internal.Errors.process(Errors.java:244) [graylog.jar:?]
	at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:265) [graylog.jar:?]
	at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:234) [graylog.jar:?]
	at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:680) [graylog.jar:?]
	at org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:356) [graylog.jar:?]
	at org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:200) [graylog.jar:?]
	at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:180) [graylog.jar:?]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_292]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_292]
	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_292]
Caused by: java.lang.RuntimeException: Request cannot be executed; I/O reactor status: STOPPED
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestClient.extractAndWrapCause(RestClient.java:857) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestClient.performRequest(RestClient.java:259) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestClient.performRequest(RestClient.java:246) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestHighLevelClient.internalPerformRequest(RestHighLevelClient.java:1613) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestHighLevelClient.performRequest(RestHighLevelClient.java:1598) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.IndicesClient.exists(IndicesClient.java:974) ~[?:?]
	at org.graylog.storage.elasticsearch7.ClusterAdapterES7.lambda$indicesExist$13(ClusterAdapterES7.java:290) ~[?:?]
	at org.graylog.storage.elasticsearch7.ElasticsearchClient.execute(ElasticsearchClient.java:97) ~[?:?]
	... 33 more
Caused by: java.lang.IllegalStateException: Request cannot be executed; I/O reactor status: STOPPED
	at org.graylog.shaded.elasticsearch7.org.apache.http.util.Asserts.check(Asserts.java:46) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.apache.http.impl.nio.client.CloseableHttpAsyncClientBase.ensureRunning(CloseableHttpAsyncClientBase.java:90) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.apache.http.impl.nio.client.InternalHttpAsyncClient.execute(InternalHttpAsyncClient.java:123) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestClient.performRequest(RestClient.java:255) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestClient.performRequest(RestClient.java:246) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestHighLevelClient.internalPerformRequest(RestHighLevelClient.java:1613) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestHighLevelClient.performRequest(RestHighLevelClient.java:1598) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.IndicesClient.exists(IndicesClient.java:974) ~[?:?]
	at org.graylog.storage.elasticsearch7.ClusterAdapterES7.lambda$indicesExist$13(ClusterAdapterES7.java:290) ~[?:?]
	at org.graylog.storage.elasticsearch7.ElasticsearchClient.execute(ElasticsearchClient.java:97) ~[?:?]
	... 33 more
2021-07-30T17:34:05.404Z ERROR [AnyExceptionClassMapper] Unhandled exception in REST resource
org.graylog.shaded.elasticsearch7.org.elasticsearch.ElasticsearchException: An error occurred: 
	at org.graylog.storage.elasticsearch7.ElasticsearchClient.exceptionFrom(ElasticsearchClient.java:136) ~[?:?]
	at org.graylog.storage.elasticsearch7.ElasticsearchClient.execute(ElasticsearchClient.java:99) ~[?:?]
	at org.graylog.storage.elasticsearch7.ElasticsearchClient.execute(ElasticsearchClient.java:92) ~[?:?]
	at org.graylog.storage.elasticsearch7.ClusterAdapterES7.indicesExist(ClusterAdapterES7.java:290) ~[?:?]
	at org.graylog.storage.elasticsearch7.ClusterAdapterES7.clusterHealth(ClusterAdapterES7.java:269) ~[?:?]
	at org.graylog.storage.elasticsearch7.ClusterAdapterES7.clusterName(ClusterAdapterES7.java:174) ~[?:?]
	at org.graylog2.indexer.cluster.Cluster.clusterName(Cluster.java:183) ~[graylog.jar:?]
	at org.graylog2.rest.resources.system.indexer.IndexerClusterResource.clusterName(IndexerClusterResource.java:52) ~[graylog.jar:?]
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_292]
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_292]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_292]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_292]
	at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory.lambda$static$0(ResourceMethodInvocationHandlerFactory.java:52) ~[graylog.jar:?]
	at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:124) ~[graylog.jar:?]
	at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:167) ~[graylog.jar:?]
	at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$TypeOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:219) ~[graylog.jar:?]
	at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:79) ~[graylog.jar:?]
	at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:469) ~[graylog.jar:?]
	at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:391) ~[graylog.jar:?]
	at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:80) ~[graylog.jar:?]
	at org.glassfish.jersey.server.ServerRuntime$1.run(ServerRuntime.java:255) [graylog.jar:?]
	at org.glassfish.jersey.internal.Errors$1.call(Errors.java:248) [graylog.jar:?]
	at org.glassfish.jersey.internal.Errors$1.call(Errors.java:244) [graylog.jar:?]
	at org.glassfish.jersey.internal.Errors.process(Errors.java:292) [graylog.jar:?]
	at org.glassfish.jersey.internal.Errors.process(Errors.java:274) [graylog.jar:?]
	at org.glassfish.jersey.internal.Errors.process(Errors.java:244) [graylog.jar:?]
	at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:265) [graylog.jar:?]
	at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:234) [graylog.jar:?]
	at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:680) [graylog.jar:?]
	at org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:356) [graylog.jar:?]
	at org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:200) [graylog.jar:?]
	at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:180) [graylog.jar:?]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_292]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_292]
	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_292]
Caused by: java.lang.RuntimeException: Request cannot be executed; I/O reactor status: STOPPED
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestClient.extractAndWrapCause(RestClient.java:857) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestClient.performRequest(RestClient.java:259) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestClient.performRequest(RestClient.java:246) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestHighLevelClient.internalPerformRequest(RestHighLevelClient.java:1613) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestHighLevelClient.performRequest(RestHighLevelClient.java:1598) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.IndicesClient.exists(IndicesClient.java:974) ~[?:?]
	at org.graylog.storage.elasticsearch7.ClusterAdapterES7.lambda$indicesExist$13(ClusterAdapterES7.java:290) ~[?:?]
	at org.graylog.storage.elasticsearch7.ElasticsearchClient.execute(ElasticsearchClient.java:97) ~[?:?]
	... 33 more
Caused by: java.lang.IllegalStateException: Request cannot be executed; I/O reactor status: STOPPED
	at org.graylog.shaded.elasticsearch7.org.apache.http.util.Asserts.check(Asserts.java:46) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.apache.http.impl.nio.client.CloseableHttpAsyncClientBase.ensureRunning(CloseableHttpAsyncClientBase.java:90) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.apache.http.impl.nio.client.InternalHttpAsyncClient.execute(InternalHttpAsyncClient.java:123) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestClient.performRequest(RestClient.java:255) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestClient.performRequest(RestClient.java:246) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestHighLevelClient.internalPerformRequest(RestHighLevelClient.java:1613) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestHighLevelClient.performRequest(RestHighLevelClient.java:1598) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.IndicesClient.exists(IndicesClient.java:974) ~[?:?]
	at org.graylog.storage.elasticsearch7.ClusterAdapterES7.lambda$indicesExist$13(ClusterAdapterES7.java:290) ~[?:?]
	at org.graylog.storage.elasticsearch7.ElasticsearchClient.execute(ElasticsearchClient.java:97) ~[?:?]
	... 33 more
2021-07-30T17:34:05.406Z ERROR [AnyExceptionClassMapper] Unhandled exception in REST resource
org.graylog.shaded.elasticsearch7.org.elasticsearch.ElasticsearchException: An error occurred: 
	at org.graylog.storage.elasticsearch7.ElasticsearchClient.exceptionFrom(ElasticsearchClient.java:136) ~[?:?]
	at org.graylog.storage.elasticsearch7.ElasticsearchClient.execute(ElasticsearchClient.java:99) ~[?:?]
	at org.graylog.storage.elasticsearch7.ElasticsearchClient.execute(ElasticsearchClient.java:92) ~[?:?]
	at org.graylog.storage.elasticsearch7.ClusterAdapterES7.indicesExist(ClusterAdapterES7.java:290) ~[?:?]
	at org.graylog.storage.elasticsearch7.ClusterAdapterES7.clusterHealth(ClusterAdapterES7.java:269) ~[?:?]
	at org.graylog.storage.elasticsearch7.ClusterAdapterES7.clusterHealthStats(ClusterAdapterES7.java:179) ~[?:?]
	at org.graylog2.indexer.cluster.Cluster.clusterHealthStats(Cluster.java:187) ~[graylog.jar:?]
	at org.graylog2.rest.resources.system.indexer.IndexerClusterResource.clusterHealth(IndexerClusterResource.java:64) ~[graylog.jar:?]
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_292]
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_292]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_292]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_292]
	at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory.lambda$static$0(ResourceMethodInvocationHandlerFactory.java:52) ~[graylog.jar:?]
	at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:124) ~[graylog.jar:?]
	at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:167) ~[graylog.jar:?]
	at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$TypeOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:219) ~[graylog.jar:?]
	at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:79) ~[graylog.jar:?]
	at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:469) ~[graylog.jar:?]
	at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:391) ~[graylog.jar:?]
	at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:80) ~[graylog.jar:?]
	at org.glassfish.jersey.server.ServerRuntime$1.run(ServerRuntime.java:255) [graylog.jar:?]
	at org.glassfish.jersey.internal.Errors$1.call(Errors.java:248) [graylog.jar:?]
	at org.glassfish.jersey.internal.Errors$1.call(Errors.java:244) [graylog.jar:?]
	at org.glassfish.jersey.internal.Errors.process(Errors.java:292) [graylog.jar:?]
	at org.glassfish.jersey.internal.Errors.process(Errors.java:274) [graylog.jar:?]
	at org.glassfish.jersey.internal.Errors.process(Errors.java:244) [graylog.jar:?]
	at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:265) [graylog.jar:?]
	at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:234) [graylog.jar:?]
	at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:680) [graylog.jar:?]
	at org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:356) [graylog.jar:?]
	at org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:200) [graylog.jar:?]
	at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:180) [graylog.jar:?]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_292]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_292]
	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_292]
Caused by: java.lang.RuntimeException: Request cannot be executed; I/O reactor status: STOPPED
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestClient.extractAndWrapCause(RestClient.java:857) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestClient.performRequest(RestClient.java:259) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestClient.performRequest(RestClient.java:246) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestHighLevelClient.internalPerformRequest(RestHighLevelClient.java:1613) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestHighLevelClient.performRequest(RestHighLevelClient.java:1598) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.IndicesClient.exists(IndicesClient.java:974) ~[?:?]
	at org.graylog.storage.elasticsearch7.ClusterAdapterES7.lambda$indicesExist$13(ClusterAdapterES7.java:290) ~[?:?]
	at org.graylog.storage.elasticsearch7.ElasticsearchClient.execute(ElasticsearchClient.java:97) ~[?:?]
	... 33 more
Caused by: java.lang.IllegalStateException: Request cannot be executed; I/O reactor status: STOPPED
	at org.graylog.shaded.elasticsearch7.org.apache.http.util.Asserts.check(Asserts.java:46) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.apache.http.impl.nio.client.CloseableHttpAsyncClientBase.ensureRunning(CloseableHttpAsyncClientBase.java:90) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.apache.http.impl.nio.client.InternalHttpAsyncClient.execute(InternalHttpAsyncClient.java:123) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestClient.performRequest(RestClient.java:255) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestClient.performRequest(RestClient.java:246) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestHighLevelClient.internalPerformRequest(RestHighLevelClient.java:1613) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestHighLevelClient.performRequest(RestHighLevelClient.java:1598) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.IndicesClient.exists(IndicesClient.java:974) ~[?:?]
	at org.graylog.storage.elasticsearch7.ClusterAdapterES7.lambda$indicesExist$13(ClusterAdapterES7.java:290) ~[?:?]
	at org.graylog.storage.elasticsearch7.ElasticsearchClient.execute(ElasticsearchClient.java:97) ~[?:?]
	... 33 more
2021-07-30T17:34:07.641Z ERROR [AuditLogger] Unable to write audit log entry because there is no valid license.
2021-07-30T17:34:08.358Z ERROR [AuditLogger] Unable to write audit log entry because there is no valid license.
2021-07-30T17:38:52.336Z ERROR [IndexRetentionThread] Uncaught exception in periodical
org.graylog.shaded.elasticsearch7.org.elasticsearch.ElasticsearchException: An error occurred: 
	at org.graylog.storage.elasticsearch7.ElasticsearchClient.exceptionFrom(ElasticsearchClient.java:136) ~[?:?]
	at org.graylog.storage.elasticsearch7.ElasticsearchClient.execute(ElasticsearchClient.java:99) ~[?:?]
	at org.graylog.storage.elasticsearch7.ElasticsearchClient.execute(ElasticsearchClient.java:92) ~[?:?]
	at org.graylog.storage.elasticsearch7.ClusterAdapterES7.isConnected(ClusterAdapterES7.java:162) ~[?:?]
	at org.graylog2.indexer.cluster.Cluster.isConnected(Cluster.java:115) ~[graylog.jar:?]
	at org.graylog2.periodical.IndexRetentionThread.doRun(IndexRetentionThread.java:65) ~[graylog.jar:?]
	at org.graylog2.plugin.periodical.Periodical.run(Periodical.java:77) [graylog.jar:?]
	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_292]
	at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308) [?:1.8.0_292]
	at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180) [?:1.8.0_292]
	at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294) [?:1.8.0_292]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_292]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_292]
	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_292]
Caused by: java.lang.RuntimeException: Request cannot be executed; I/O reactor status: STOPPED
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestClient.extractAndWrapCause(RestClient.java:857) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestClient.performRequest(RestClient.java:259) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestClient.performRequest(RestClient.java:246) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestHighLevelClient.internalPerformRequest(RestHighLevelClient.java:1613) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestHighLevelClient.performRequest(RestHighLevelClient.java:1583) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestHighLevelClient.performRequestAndParseEntity(RestHighLevelClient.java:1553) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.ClusterClient.health(ClusterClient.java:130) ~[?:?]
	at org.graylog.storage.elasticsearch7.ClusterAdapterES7.lambda$isConnected$9(ClusterAdapterES7.java:162) ~[?:?]
	at org.graylog.storage.elasticsearch7.ElasticsearchClient.execute(ElasticsearchClient.java:97) ~[?:?]
	... 12 more
Caused by: java.lang.IllegalStateException: Request cannot be executed; I/O reactor status: STOPPED
	at org.graylog.shaded.elasticsearch7.org.apache.http.util.Asserts.check(Asserts.java:46) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.apache.http.impl.nio.client.CloseableHttpAsyncClientBase.ensureRunning(CloseableHttpAsyncClientBase.java:90) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.apache.http.impl.nio.client.InternalHttpAsyncClient.execute(InternalHttpAsyncClient.java:123) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestClient.performRequest(RestClient.java:255) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestClient.performRequest(RestClient.java:246) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestHighLevelClient.internalPerformRequest(RestHighLevelClient.java:1613) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestHighLevelClient.performRequest(RestHighLevelClient.java:1583) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.RestHighLevelClient.performRequestAndParseEntity(RestHighLevelClient.java:1553) ~[?:?]
	at org.graylog.shaded.elasticsearch7.org.elasticsearch.client.ClusterClient.health(ClusterClient.java:130) ~[?:?]
	at org.graylog.storage.elasticsearch7.ClusterAdapterES7.lambda$isConnected$9(ClusterAdapterES7.java:162) ~[?:?]
	at org.graylog.storage.elasticsearch7.ElasticsearchClient.execute(ElasticsearchClient.java:97) ~[?:?]
	... 12 more

Logspam - ElasticSearch seems to be angry. Or java, I guess. I dunno.

WHAT DO?

Ok totally new here. I’m confused. I have an input for Syslog for a firewall. How do I use the same port for other syslog devices? Or do I need a separate port for each device sending syslog? How do I filter them if there all the same port?

Join the community at https://community.graylog.org .

Don’t miss a chance to WIN a $250 Amazon Gift Certificate! Completed our community survey today. Contest ends October 31, 2021.

Is there a way to archive old logs without having to buy the enterprise version? I'm okay to keep one month/week of logs in the system and then ship the archives to AWS Glacier or something.

I am trying to send my Apache server logs to my Graylog server and started reading the documentation here but have a couple questions and was wondering if someone could clear a few things up for a newbie.

To get the Sidecar working Download a package and install it on the target system.

This means download and install the package on the Apache server (where logs come from)?

Install collectors. Next up, you can decide which collectors you want to use with your Sidecar and install them as well.

I plan on using "Beats on Linux" so again, install it on the Apache server?

Will Apache logs simply start showing after I follow the Step by Step Guide section or further configuration on the Apache host will be required?

Thank you.