Re: [graylog2] Grok patterns list is empty
It was installed using your puppet module. And I think it's been 2.1.2 from the start. Best regards, David On December 28, 2016 2:01:30 PM GMT+01:00, Edmundo Alvarez wrote: >Good to read you solved the issue :-) > >We ship some common patterns as part of the base installation, I am not >sure why they were not present in your case. How did you install >Graylog? Also, was it an upgrade from a previous version? This >information will allow us to further investigate if this is a common >issue. > >Thank you, > >Edmundo > >> On 28 Dec 2016, at 13:45, David Raison >wrote: >> >> >> >> On 28/12/16 13:38, David Raison wrote: >>> Ha, that seems to be the problem. I don't have such a collection at >all. >>> However, the patterns seem to be in content_packs, but not used on >the >>> frontend. >> >> Oook. So after importing the content pack, navigate to System > >Content >> Packs and actually activate it ;) >> >> Shouldn't the grok patterns be part of the base installation though? >> >> Best regards, >> David >>> >> >> -- >> TenTwentyFour S.à r.l. >> W: www.tentwentyfour.lu >> T: +352 20 211 1024 >> F: +352 20 211 1023 >> 9 av. des Hauts-Fourneaux >> 4362 Esch-sur-Alzette >> >> >> -- >> You received this message because you are subscribed to the Google >Groups "Graylog Users" group. >> To unsubscribe from this group and stop receiving emails from it, >send an email to graylog2+unsubscr...@googlegroups.com. >> To view this discussion on the web visit >https://groups.google.com/d/msgid/graylog2/f33afd96-27d8-39ed-21c8-7e05b68b1a21%40tentwentyfour.lu. >> For more options, visit https://groups.google.com/d/optout. > >-- >You received this message because you are subscribed to the Google >Groups "Graylog Users" group. >To unsubscribe from this group and stop receiving emails from it, send >an email to graylog2+unsubscr...@googlegroups.com. >To view this discussion on the web visit >https://groups.google.com/d/msgid/graylog2/FCAC6C86-8835-47B9-B375-8649DA10F717%40graylog.com. >For more options, visit https://groups.google.com/d/optout. -- Sent from my Android device with K-9 Mail. Please excuse my brevity. -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/9FE5CF49-826E-47CC-A013-A241F93B469B%40tentwentyfour.lu. For more options, visit https://groups.google.com/d/optout.
Re: [graylog2] Grok patterns list is empty
Good to read you solved the issue :-) We ship some common patterns as part of the base installation, I am not sure why they were not present in your case. How did you install Graylog? Also, was it an upgrade from a previous version? This information will allow us to further investigate if this is a common issue. Thank you, Edmundo > On 28 Dec 2016, at 13:45, David Raison wrote: > > > > On 28/12/16 13:38, David Raison wrote: >> Ha, that seems to be the problem. I don't have such a collection at all. >> However, the patterns seem to be in content_packs, but not used on the >> frontend. > > Oook. So after importing the content pack, navigate to System > Content > Packs and actually activate it ;) > > Shouldn't the grok patterns be part of the base installation though? > > Best regards, > David >> > > -- > TenTwentyFour S.à r.l. > W: www.tentwentyfour.lu > T: +352 20 211 1024 > F: +352 20 211 1023 > 9 av. des Hauts-Fourneaux > 4362 Esch-sur-Alzette > > > -- > You received this message because you are subscribed to the Google Groups > "Graylog Users" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to graylog2+unsubscr...@googlegroups.com. > To view this discussion on the web visit > https://groups.google.com/d/msgid/graylog2/f33afd96-27d8-39ed-21c8-7e05b68b1a21%40tentwentyfour.lu. > For more options, visit https://groups.google.com/d/optout. -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/FCAC6C86-8835-47B9-B375-8649DA10F717%40graylog.com. For more options, visit https://groups.google.com/d/optout.
Re: [graylog2] Grok patterns list is empty
On 28/12/16 13:38, David Raison wrote: > Ha, that seems to be the problem. I don't have such a collection at all. > However, the patterns seem to be in content_packs, but not used on the > frontend. Oook. So after importing the content pack, navigate to System > Content Packs and actually activate it ;) Shouldn't the grok patterns be part of the base installation though? Best regards, David > -- TenTwentyFour S.à r.l. W: www.tentwentyfour.lu T: +352 20 211 1024 F: +352 20 211 1023 9 av. des Hauts-Fourneaux 4362 Esch-sur-Alzette -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/f33afd96-27d8-39ed-21c8-7e05b68b1a21%40tentwentyfour.lu. For more options, visit https://groups.google.com/d/optout. signature.asc Description: OpenPGP digital signature
Re: [graylog2] Grok patterns list is empty
On 28/12/16 10:50, Edmundo Alvarez wrote: > I would start by checking if the grok patterns got stored in the database. > Could you please check if there are some documents in the "grok_patterns" > collection inside the MongoDB database you use for Graylog? Ha, that seems to be the problem. I don't have such a collection at all. However, the patterns seem to be in content_packs, but not used on the frontend. >> db.content_packs.find() > { "_id" : ObjectId("5834a20185a3f75aaba06c48"), "name" : "Core Grok > Patterns", "description" : "Core grok patterns", "category" : "Grok", > "inputs" : [ ] … Can I make graylog re-create the grok_patterns collection, or create it myself? > Additionally, which Graylog version are you using? A link to the grok > patterns you imported would also help us to see if there's anything odd in > there. I imported these patterns: https://marketplace.graylog.org/addons/407e8aa2-67b2-41a7-9bf5-9fc7f7d3915b > *** 2.1.2-1 0 > 500 https://downloads.graylog.org/repo/debian/ stable/2.1 > amd64 Packages best regards, David -- TenTwentyFour S.à r.l. W: www.tentwentyfour.lu T: +352 20 211 1024 F: +352 20 211 1023 9 av. des Hauts-Fourneaux 4362 Esch-sur-Alzette -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/388365f8-23a0-9959-9aea-39070b440dd1%40tentwentyfour.lu. For more options, visit https://groups.google.com/d/optout. signature.asc Description: OpenPGP digital signature
Re: [graylog2] Grok patterns list is empty
Hi David, I would start by checking if the grok patterns got stored in the database. Could you please check if there are some documents in the "grok_patterns" collection inside the MongoDB database you use for Graylog? Additionally, which Graylog version are you using? A link to the grok patterns you imported would also help us to see if there's anything odd in there. Regards, Edmundo > On 27 Dec 2016, at 23:01, David Raison wrote: > > Hi, > > I'm running two graylog instances and on one of them, the list of grok > patterns is empty, just displaying "No data available." > > I've tried importing the default patterns from the marketplace, the import > succeeds, but the result is the same, still "No data available". > This also means I cannot use any grok patterns for extractors. > > I have no related error messages in the graylog-server/server.log file and no > errors in the web overview either. I'm at a loss here and would greatly > appreciate your help in hinting at what I could check next. > > Thanks, > David > > -- > You received this message because you are subscribed to the Google Groups > "Graylog Users" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to graylog2+unsubscr...@googlegroups.com. > To view this discussion on the web visit > https://groups.google.com/d/msgid/graylog2/5f4e8660-b790-4961-a5b0-44c0277f019a%40googlegroups.com. > For more options, visit https://groups.google.com/d/optout. > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/D27D1B92-8BA7-420B-A99F-A32AE367734B%40graylog.com. For more options, visit https://groups.google.com/d/optout.