Hi Bryan, you can manually set the IP address for the embedded Elasticsearch instance in Graylog using the elasticsearch_network_host setting in the configuration file (see https://github.com/Graylog2/graylog2-server/blob/2.0.0/misc/graylog.conf#L187-L192) if the automatically discovered IP address isn't correct.
Regarding the web_listen_uri and rest_listen_uri settings, their default value is http://127.0.0.1:9000/ and http://127.0.0.1:12900/ respectively, to avoid accidentally listening on a public interface. Cheers, Jochen On Wednesday, 27 April 2016 22:55:58 UTC+2, Bryan Vukich wrote: > > Centos 7 > graylog-server.noarch 2.0.0-5 > elasticsearch.noarch 2.3.2-1 > Both from yum repositories. > > Graylog-server and Elasticsearch are installed on two different servers. > When graylog tries to connect to es it appears to be telling es to connect > back on the wrong IP. I'm seeing the following log on the graylog server: > > > 2016-04-27T14:52:12.246-05:00 INFO [zen] > [graylog-71192b15-8a49-4f65-847f-cc62028fa176] failed to send join request > to master > [{Scarecrow}{PQaL_Ar1QW6ZLtuGHPWnZw}{10.100.10.222}{10.100.10.222:9300}], > reason > [RemoteTransportException[[Scarecrow][10.100.10.222:9300][internal:discovery/zen/join]]; > > nested: > ConnectTransportException[[graylog-71192b15-8a49-4f65-847f-cc62028fa176][ > 127.0.0.1:9350] connect_timeout[30s]]; nested: > NotSerializableExceptionWrapper[connect_exception: Connection refused: / > 127.0.0.1:9350]; ] > > > There doesn't appear to be anywhere in the server.conf that sets a listen > or announce IP for the es client, although there is one to override the > default port of 9350. > > [root@HRTV-GSW001 ~]# ss -ln | grep 9350 > tcp LISTEN 0 50 ::ffff:127.0.0.1:9350 > :::* > tcp LISTEN 0 50 ::1:9350 :::* > > > I should note the web interface and API bind addresses were also > autodiscovered incorrectly (by default only listen on 127.0.0.1), and > needed to be set manually. They did not need to be set manually on > graylog-server 1.3.4. > > I was able to make it work be creating an SSH tunnel from the ES box to > the graylog box. > > > ssh -L 9350:localhost:9350 root@HRTV-GSW001 > > > Any thoughts? > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/a150c052-5f99-4921-a510-6883e2e22b71%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
