Hi Raj, please make sure that the other nodes of the Elasticsearch cluster are able to communicate with the embedded ES node in Graylog. Currently, the embedded ES node in Graylog is announcing 127.0.0.1 as its address, to which the other ES nodes can't connect to.
You can change the address of the embedded ES node using the elasticsearch_network_host configuration setting in your Graylog configuration file (see https://github.com/Graylog2/graylog2-server/blob/2.0.0/misc/graylog.conf#L187-L194 ). Cheers, Jochen On Thursday, 5 May 2016 15:17:50 UTC+2, raj kumar wrote: > > Hi guys, > > I have configured a single node Graylog v-2.0 and trying to connect > it with 2 node Elasticsearch cluster. > please help me to resolve this issue. > > *tailf /var/log/graylog-server/server.log* > > INFO [zen] [graylog-b9937cde-72c3-4d50-969c-712deebdc895] failed to send > join request to master > [{DB2}{FQYpYX6DSbCBWHIE0ca_vA}{192.168.100.63}{192.168.100.63:9300}], > reason > [RemoteTransportException[[DB2][192.168.100.63:9300][internal:discovery/zen/join]]; > > nested:ConnectTransportException[[graylog-b9937cde-72c3-4d50-969c-712deebdc895][ > 127.0.0.1:9350] connect_timeout[30s]]; nested: > NotSerializableExceptionWrapper[connect_exception: Connection refused: / > 127.0.0.1:9350]; ] > > *tailf /var/log/elasticsearch/elasticsearch.log* > > [INFO ][transport ] [Skullcrusher] publish_address { > 127.0.0.1:9300}, bound_addresses {[::1]:9300}, {127.0.0.1:9300} > [INFO ][discovery ] [Skullcrusher] > elasticsearch/IWGO-rDBQ6-5Gz1nmHQ_gg > [cluster.service ] [Skullcrusher] new_master > {Skullcrusher}{IWGO-rDBQ6-5Gz1nmHQ_gg}{127.0.0.1}{127.0.0.1:9300}, > reason: zen-disco-join(elected_as_master, [0] joins received) > [INFO ][http ] [Skullcrusher] publish_address { > 127.0.0.1:9200}, bound_addresses {[::1]:9200}, {127.0.0.1:9200} > [INFO ][node ] [Skullcrusher] started > [INFO ][gateway ] [Skullcrusher] recovered [0] indices > into cluster_state > [INFO ][node ] [Skullcrusher] stopping ... > [INFO ][node ] [Skullcrusher] stopped > [INFO ][node ] [Skullcrusher] closing ... > [INFO ][node ] [Skullcrusher] closed > > *# cat /etc/graylog/server/server.conf* > is_master = true > node_id_file = /etc/graylog/server/node-id > password_secret = XXXXXXXXXXXXXXXXXXXXXX > root_username = admin > root_password_sha2 = XXXXXXXXXXXXXXXXXXXX > root_timezone = Asia/Kolkata > plugin_dir = /usr/share/graylog-server/plugin > rest_listen_uri = http://192.168.100.61:12900/ > web_listen_uri = http://192.168.100.61:9000/ > web_enable = true > rotation_strategy = count > elasticsearch_max_docs_per_index = 20000000 > elasticsearch_max_number_of_indices = 20 > retention_strategy = delete > elasticsearch_shards = 2 > elasticsearch_replicas = 0 > elasticsearch_index_prefix = graylog > allow_leading_wildcard_searches = false > allow_highlighting = false > elasticsearch_cluster_name = graylog > elasticsearch_discovery_zen_ping_unicast_hosts = 192.168.100.62:9300, > 192.168.100.63:9300 > elasticsearch_discovery_zen_ping_multicast_enabled = false > elasticsearch_cluster_discovery_timeout = 5000 > elasticsearch_discovery_initial_state_timeout = 12s > elasticsearch_analyzer = standard > output_batch_size = 500 > output_flush_interval = 1 > output_fault_count_threshold = 5 > output_fault_penalty_seconds = 30 > processbuffer_processors = 5 > outputbuffer_processors = 3 > processor_wait_strategy = blocking > ring_size = 65536 > inputbuffer_ring_size = 65536 > inputbuffer_processors = 2 > inputbuffer_wait_strategy = blocking > message_journal_enabled = true > message_journal_dir = /var/lib/graylog-server/journal > lb_recognition_period_seconds = 3 > mongodb_uri = mongodb://192.168.100.61/graylog > mongodb_max_connections = 300 > mongodb_threads_allowed_to_block_multiplier = 5 > content_packs_dir = /usr/share/graylog-server/contentpacks > content_packs_auto_load = grok-patterns.json > > *# /etc/elasticsearch/elasticsearch.yml* > cluster.name: graylog > script.inline: false > script.indexed: false > script.file: false > node.name: "DB2" > bootstrap.mlockall: true > discovery.zen.ping.multicast.enabled: false > discovery.zen.ping.unicast.hosts: ["192.168.100.62:9300"," > 192.168.100.63:9300"] > indices.store.throttle.max_bytes_per_sec: 150mb > path.data: /elastic/data > http.port: 9200 > http.enabled: true > network.host: 192.168.100.63 > node.data: true > node.master: true > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/e03633b2-dd9c-4bc9-a088-4d37909f5c3e%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
