This is covered in the documentation here: http://docs.graylog.org/en/2.0/pages/configuring_webif.html?highlight=rest_transport_uri#making-the-web-interface-work-with-load-balancers-proxies
`web_listen_uri` should be set to some port that is allowed by your security group and the ELB updated to forward to the instance 12900 port and permissions added for that port. On Thursday, May 26, 2016 at 10:47:07 AM UTC-5, Pranay Manwatkar wrote: > > *### Problem description* > I am unable to understand why browser is redirecting the ELB request to > internal IP 12900. > What am I missing in configuration. I am getting this error as I blocked > the security group to access 12900 directly from browser host. What port I > need to add so that request does not go directly to internal instances on > rest_listen_uri port. > ``` > *Error message* > Bad request > *Original Request* > GET http://10.2.93.6:12900/system/cluster/node > *Status code* > undefined > *Full error message* > Error: Request has been terminated Possible causes: the network is > offline, Origin is not allowed by Access-Control-Allow-Origin, the page is > being unloaded, etc. > ``` > > *### Steps to reproduce the problem* > As per http://docs.graylog.org/en/2.0/pages/architecture.html for bigger > setup I have added AWS ELB in front of graylog-server > ELB http port: 80 > Instance http port: 9000 > > Graylog server: 10.2.93.6 > Elasticsearch: 10.2.68.102 > > graylog-server.conf:: > ``` > is_master = true > node_id_file = /etc/graylog/server/node-id > password_secret = XXXXXXXXXXXXXXX > root_username = admin > root_password_sha2 = YXXXXXXXXXXXXXXXY > plugin_dir = plugin > rest_listen_uri = http://0.0.0.0:12900/ > web_listen_uri = http://0.0.0.0:9000/ > web_enable_cors = false > rotation_strategy = time > elasticsearch_max_time_per_index = 3d > elasticsearch_max_number_of_indices = 20 > retention_strategy = delete > elasticsearch_shards = 2 > elasticsearch_replicas = 0 > elasticsearch_index_prefix = graylog > allow_leading_wildcard_searches = true > allow_highlighting = false > elasticsearch_cluster_name = graylog > elasticsearch_discovery_zen_ping_unicast_hosts = 10.2.68.102:9300 > elasticsearch_discovery_zen_ping_multicast_enabled = false > elasticsearch_cluster_discovery_timeout = 5000 > elasticsearch_discovery_initial_state_timeout = 15s > elasticsearch_analyzer = standard > elasticsearch_network_host = 10.2.93.6 > output_batch_size = 500 > output_flush_interval = 1 > output_fault_count_threshold = 5 > output_fault_penalty_seconds = 30 > processbuffer_processors = 5 > outputbuffer_processors = 3 > processor_wait_strategy = blocking > ring_size = 65536 > inputbuffer_ring_size = 65536 > inputbuffer_processors = 2 > inputbuffer_wait_strategy = blocking > message_journal_enabled = true > message_journal_dir = data/journal > lb_recognition_period_seconds = 3 > mongodb_uri = mongodb://mongodb.test.com:27017/db1 > mongodb_max_connections = 1000 > mongodb_threads_allowed_to_block_multiplier = 5 > content_packs_auto_load = grok-patterns.json > ``` > > elasticsearch.yml > ``` > cluster.name: graylog > node.master: true > node.data: true > index.number_of_shards: 2 > index.number_of_replicas: 0 > index.replication: async > index.refresh_interval: 30s > path.data: /var/lib/elasticsearch/data-0, /var/lib/elasticsearch/data-1 > path.logs: /var/lib/elasticsearch/logs > bootstrap.mlockall: true > ES_HEAP_SIZE: 3g > MAX_LOCKED_MEMORY: unlimited > transport.tcp.compress: true > http.compression: true > http.cors.enabled: true > discovery.zen.minimum_master_nodes: 1 > discovery.zen.ping.multicast.enabled: false > discovery.zen.ping.unicast.hosts: ["10.2.68.102:9300"] > discovery.type: ec2 > discovery.ec2.host_type: private_ip > discovery.ec2.ping_timeout: 5s > cloud.aws.region: us-east-1 > discovery.ec2.tag.Role: haystack-es > jmx.create_connector: true > jmx.port: 1099 > jmx.domain: elasticsearch > index.search.slowlog.level: DEBUG > index.search.slowlog.threshold.query.warn: 10s > index.search.slowlog.threshold.query.info: 5s > index.search.slowlog.threshold.query.debug: 2s > index.search.slowlog.threshold.query.trace: 500ms > index.search.slowlog.threshold.fetch.warn: 1s > index.search.slowlog.threshold.fetch.info: 800ms > index.search.slowlog.threshold.fetch.debug: 500ms > index.search.slowlog.threshold.fetch.trace: 200ms > index.indexing.slowlog.level: DEBUG > index.indexing.slowlog.threshold.index.warn: 10s > index.indexing.slowlog.threshold.index.info: 5s > index.indexing.slowlog.threshold.index.debug: 2s > index.indexing.slowlog.threshold.index.trace: 500ms > node.name: ${HOSTNAME} > network.bind_host: 0.0.0.0 > network.host: 10.2.68.102 > cloud.node.auto_attributes: true > cluster.routing.allocation.awareness.attributes: aws_availability_zone > ``` > > *### Environment* > > - Graylog Version: 2.0.1 > - Elasticsearch Version: 2.3.3 > - MongoDB Version: 3.0.2-1.amzn1 > - Operating System: graylog on centos-el7.x86_64 | elasticsearch on > 4.4.10-22.54.amzn1.x86_64 > - Browser version: Chrome 50.0.2661.102 > > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/d4816ddb-5007-4190-81ee-336d823ff6a6%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
