Hi Tyler! Have you double checked both the cluster.name on the master as well as the version of Elasticsearch? Graylog in the version you are running is using Elasticsearch 1.3.7.
It looks like Graylog can successfully reach your master node for discovery, but then fails to join the cluster. This usually indicates a problem with the cluster names, unfortunately Elasticsearch does not print a more helpful message in this case. Did this work before? What has changed? Best regards, Kay > On 02 Jun 2015, at 20:06, ty...@ospreyinformatics.com wrote: > > Hello, > > We had a Graylog instance running and connected to our elasticsearch cluster. > We performed a rolling restart of the ES nodes to install an ES plugin and > then restarted the Graylog server. > > Now the graylog-server instance is unable to connect to the elasticsearch > cluster. I've ensured that multi-cast is disabled and that the unicast > discovery hosts, matching the elasticsearch config. > > We using Debian with Graylog installed via the .deb in AWS. Our elasticsearch > cluster has one master node (set in the discovery) and multiple data nodes. > > The elasticsearch.yml file being used for configuration > (/etc/graylog/server/elasticsearch.yml) will connect to the ES cluster if I > use it with the elasticsearch service on the same machine as the graylog > instance, so it does not appear to be an issue with firewalls, connectivity > between the graylog server and our ES master. > > I've tried various combinations of binding network and publish hosts to the > external and private IPs of the instance as well as swapping the URL in the > unicast discovery setting to the ip address of the master node as well as > completely uninstalling both elasticsearch and graylog, restarting the > machine and re-installing. > > To keep the post clean, I've attached sanitized versions of our graylog > config, elasticsearch and the log file with debug enabled. > > Any help/comments/ideas are greatly appreciated. > > Cheers, > Tyler > > -- > You received this message because you are subscribed to the Google Groups > "graylog2" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to graylog2+unsubscr...@googlegroups.com > <mailto:graylog2+unsubscr...@googlegroups.com>. > For more options, visit https://groups.google.com/d/optout > <https://groups.google.com/d/optout>. > <elasticsearch.yml><server.conf><server.log> -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
