Hi Nathan, check all of your logs (Graylog and Elasticsearch). Each will tell you which network interface they are listening to and how and where they want to connect.
Cheers, Jochen On Tuesday, 2 August 2016 15:32:31 UTC+2, Nathan Mace wrote: > > I made the changes, or at least the changes I understood. I'm not sure > what you mean by the cluster.name setting being incorrect on the second > node. I also am confused by the network.host setting on each ES node. It > is customized to my network, each one is set to the servers respective IP > address. > > Now that I made the change and restarted services, in Graylog it still > shows only 1 node, the field for "Elasticsearch Cluster" just sits and > spins, and I have a number of unprocessed messages. > > Any ideas? > > Nathan > > On Tuesday, August 2, 2016 at 6:38:45 AM UTC-4, Jochen Schalanda wrote: >> >> Hi Nathan, >> >> check the elasticsearch_network_host setting of your Graylog nodes. It >> should be set to one (and only one!) public IP address of the Graylog node >> which can be accessed by all other Elasticsearch nodes in the cluster. >> elasticsearch_discovery_zen_ping_unicast_hosts should be a >> comma-separated list of host/port pairs containing the addresses of the >> Elasticsearch nodes, for example: >> >> elasticsearch_discovery_zen_ping_unicast_hosts = x.x.x.146:9300, x.x.x.149 >> >> >> See >> http://docs.graylog.org/en/2.0/pages/configuration/elasticsearch.html#network-setup >> >> for details. >> >> Additionally, the cluster.name of your second Elasticsearch node is >> unset, which makes it default to "elasticsearch". The logs of that >> Elasticsearch node should show this pretty clearly. >> >> Also take a look at the network.host settings of both your Elasticsearch >> nodes. This setting must be customized to your network setup, otherwise >> they'll only bind to the local network interface (i. e. 127.0.0.1 or ::1). >> See >> https://www.elastic.co/guide/en/elasticsearch/reference/2.3/modules-network.html#common-network-settings >> >> for details. >> >> Cheers, >> Jochen >> >> On Monday, 1 August 2016 22:15:32 UTC+2, Nathan Mace wrote: >>> >>> Primary node (MonoDB, Graylog, and ES): IP Address: x.x.x.146 >>> Secondary Node (ES Only): IP Address: x.x.x.149 >>> >>> Both on the same subnet. Can ping each other. >>> […] >>> >> -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/7597af15-a41e-414c-a410-e28d40bbf99a%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
