Got the same issue here. Graylog-Server (2.0.0.-5) connecting to external Elasticsearch Server.
Elasticsearch Config Changes: cluster.name: graylog network.host: 0.0.0.0 discovery.zen.ping.multicast.enabled: false discovery.zen.ping.unicast.hosts: ["publicipelasticsearchserver:9300"] Graylog Server Config Changes regarding ES: elasticsearch_shards = 1 elasticsearch_replicas = 0 elasticsearch_index_prefix = graylog elasticsearch_cluster_name = graylog elasticsearch_node_name_prefix = graylog- elasticsearch_discovery_zen_ping_unicast_hosts = publicelasticsearchserver:9300 Elasticsearch Health: http://publicelasticsearchserver:9200/_cluster/health?pretty=true { "cluster_name" : "graylog", "status" : "green", "timed_out" : false, "number_of_nodes" : 1, "number_of_data_nodes" : 1, "active_primary_shards" : 0, "active_shards" : 0, "relocating_shards" : 0, "initializing_shards" : 0, "unassigned_shards" : 0, "delayed_unassigned_shards" : 0, "number_of_pending_tasks" : 0, "number_of_in_flight_fetch" : 0, "task_max_waiting_in_queue_millis" : 0, "active_shards_percent_as_number" : 100.0 } Getting following error: 2016-04-28T11:17:58.424+02:00 INFO [zen] [graylog-ef071c7d-1e72-4cb2-ab00-502b397d12fd] failed to send join request to master [{Dan Ketch}{V4-j79OyTI62AQ-vir351g}{publicelasticsearchserver}{publicelasticsearchserver:9300}], reason [RemoteTransportException[[Dan Ketch][publicelasticsearchserver:9300][internal:discovery/zen/join]]; nested: ConnectTransportException[[graylog-ef071c7d-1e72-4cb2-ab00-502b397d12fd][127.0.0.1:9350] connect_timeout[30s]]; nested: NotSerializableExceptionWrapper[connect_exception: Connection refused: /127.0.0.1:9350]; ] On webinterface: Error messageBad requestOriginal RequestGET http://127.0.0.1:12900/system/cluster/nodeStatus codeundefinedFull error messageError: Request has been terminated Possible causes: the network is offline, Origin is not allowed by Access-Control-Allow-Origin, the page is being unloaded, etc. Setting elasticsearch_network_host won't make any difference. Best regards, Thomas Am Donnerstag, 28. April 2016 09:39:21 UTC+2 schrieb Jochen Schalanda: > > Hi Bryan, > > you can manually set the IP address for the embedded Elasticsearch > instance in Graylog using the elasticsearch_network_host setting in the > configuration file (see > https://github.com/Graylog2/graylog2-server/blob/2.0.0/misc/graylog.conf#L187-L192) > > if the automatically discovered IP address isn't correct. > > Regarding the web_listen_uri and rest_listen_uri settings, their default > value is http://127.0.0.1:9000/ and http://127.0.0.1:12900/ respectively, > to avoid accidentally listening on a public interface. > > > Cheers, > Jochen > > On Wednesday, 27 April 2016 22:55:58 UTC+2, Bryan Vukich wrote: >> >> Centos 7 >> graylog-server.noarch 2.0.0-5 >> elasticsearch.noarch 2.3.2-1 >> Both from yum repositories. >> >> Graylog-server and Elasticsearch are installed on two different servers. >> When graylog tries to connect to es it appears to be telling es to connect >> back on the wrong IP. I'm seeing the following log on the graylog server: >> >> >> 2016-04-27T14:52:12.246-05:00 INFO [zen] >> [graylog-71192b15-8a49-4f65-847f-cc62028fa176] failed to send join request >> to master >> [{Scarecrow}{PQaL_Ar1QW6ZLtuGHPWnZw}{10.100.10.222}{10.100.10.222:9300}], >> reason >> [RemoteTransportException[[Scarecrow][10.100.10.222:9300][internal:discovery/zen/join]]; >> >> nested: >> ConnectTransportException[[graylog-71192b15-8a49-4f65-847f-cc62028fa176][ >> 127.0.0.1:9350] connect_timeout[30s]]; nested: >> NotSerializableExceptionWrapper[connect_exception: Connection refused: / >> 127.0.0.1:9350]; ] >> >> >> There doesn't appear to be anywhere in the server.conf that sets a listen >> or announce IP for the es client, although there is one to override the >> default port of 9350. >> >> [root@HRTV-GSW001 ~]# ss -ln | grep 9350 >> tcp LISTEN 0 50 ::ffff:127.0.0.1:9350 >> :::* >> tcp LISTEN 0 50 ::1:9350 :::* >> >> >> I should note the web interface and API bind addresses were also >> autodiscovered incorrectly (by default only listen on 127.0.0.1), and >> needed to be set manually. They did not need to be set manually on >> graylog-server 1.3.4. >> >> I was able to make it work be creating an SSH tunnel from the ES box to >> the graylog box. >> >> >> ssh -L 9350:localhost:9350 root@HRTV-GSW001 >> >> >> Any thoughts? >> > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/eadcc33e-01bd-47ba-ac06-7761b8fb022c%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
