Hello Edmundo, now I configured NTP to work with our local time server and the cluster works better (I can see the inputs on the both cluster nodes again). May be you can add a hint in the documentation to (re)configure NTP if your graylog servers don't have access to public time servers.
Once I configured the email alerts I had problems with the field from email. I didn't realize first, that the parameter *from-email*, which is configured with the graylog-ctl script is the same as the field *sender* in the email alert callback. So I searched for a wrong graylog-ctl configuration, but the problem was just the field sender (with the default [email protected]) in the email alert callback. This sender was refused (correctly) by the Exchange server. And small hint in the documentation of the graylog-ctl script would be helpful. Regards, Dietmar On Friday, June 17, 2016 at 12:53:06 PM UTC+2, Dietmar Schurr wrote: > > Hello Edmundo, > > I just tried to regenerate the error, but it just worked, that is the > error did not came up. So may be the problem was somewhere else. > > In the graylog cluster I discovered diverging system times (about 20 sec), > so may be this is part of the problem. > I will try to fix this on monday, when my vmware colleagues are back, > because I would like to tackle the system time problem on the ESX VMware > level. > > Thanks a lot for your help, I will come back if I experience similar > problems. > > Regards, > > Dietmar > > On Thursday, June 16, 2016 at 6:56:22 PM UTC+2, Edmundo Alvarez wrote: >> >> Hi Dietmar, >> >> I just tried creating an extractor just like that in IE 11 and Chrome and >> seems to work. Could you please capture the network request that was made >> to the server, so we can further investigate the issue? Here is how using >> Chrome/Chromium: >> >> 1. Fill out the create extractor form as you usually do, but do not press >> the save button >> 2. Open the developer tools in your browser as explained here: >> https://developers.google.com/web/tools/chrome-devtools/ >> 3. Once you are in the network tab and you are capturing traffic, press >> the save button, and see the error message >> 4. Go back to the network tab in the developer tools, and see the request >> that was made to "extractors", as they explain here: >> https://developers.google.com/web/tools/chrome-devtools/profile/network-performance/resource-loading#view-details-for-a-single-resource >> 5. Share the details in the "Headers" tab with us, specially the request >> payload >> >> This is an example of what it looks like, just in case it helps: >> >> Thank you, >> Edmundo >> >> On 16 Jun 2016, at 12:44, Dietmar Schurr <[email protected]> wrote: >> >> Hello Edmundo, >> >> this is Graylog 2.0.2 in a cluster of two VM appliances running under >> VMware. >> The behaviour was the same on IE11 (Windows) and Chromium (from a Linux >> system). >> If I edit the same Extractor definition I don't get this error.... >> >> Regards, >> >> Dietmar Schurr >> >> On Wednesday, June 15, 2016 at 5:39:38 PM UTC+2, Edmundo Alvarez wrote: >> Hi Dietmar, >> >> Would you be so kind as to tell us which Graylog version and browser you >> use? Additionally, do you see any errors in your browser's developer >> console when the error occurs? This is how you can open the developer >> console in Chrome, it's similar in other browsers: >> https://developers.google.com/web/tools/chrome-devtools/ >> >> Regards, >> Edmundo >> >> > On 15 Jun 2016, at 16:07, Dietmar Schurr <[email protected]> wrote: >> > >> > Hello, >> > >> > if I choose the Condition Only attempt extraction if field contains >> string it works. >> > Hmm, I wonder why. The Grok pattern is the same. >> > >> > Regards, >> > >> > Dietmar Schurr >> > >> > On Tuesday, June 14, 2016 at 3:08:49 PM UTC+2, Dietmar Schurr wrote: >> > Hello, >> > >> > now I have another problem: >> > I try to apply an extractor to an input. >> > >> > I go to Systems/Input and choose "Manage extractors" next to the Input >> I want to have it. >> > >> > In the wizard I click on "Get started" and load a message. >> > >> > I select "Grok Pattern" next to the field "message". Here I enter my >> grok pattern in the field "Grok pattern". >> > If I click on "Try" it works nice and all fields are extracted. >> > >> > Now I enter a name like test_extracotr in the field "Extractor title". >> > >> > If I click on "Create extractor" I get this error message: >> > >> > >> > >> > What am I doing wrong here? >> > >> > Thanks in advance for your help. >> > >> > Regards, >> > >> > Dietmar Schurr >> > >> > -- >> > You received this message because you are subscribed to the Google >> Groups "Graylog Users" group. >> > To unsubscribe from this group and stop receiving emails from it, send >> an email to [email protected]. >> > To view this discussion on the web visit >> https://groups.google.com/d/msgid/graylog2/a778c117-043c-41dc-b0d9-c748a86963b6%40googlegroups.com >> . >> > For more options, visit https://groups.google.com/d/optout. >> >> >> -- >> You received this message because you are subscribed to the Google Groups >> "Graylog Users" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> To view this discussion on the web visit >> https://groups.google.com/d/msgid/graylog2/eed2ce38-462d-4402-aea6-a762e88230df%40googlegroups.com >> . >> For more options, visit https://groups.google.com/d/optout. >> >> >> -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/38b3fa43-b04a-4d08-9194-a25093870a3e%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
