Input Diagnosis

The final step in setting up an input is verifying that it launched successfully on the Input Diagnosis page. The Input Diagnosis page is a built-in Graylog tool for testing and troubleshooting input configurations. It helps confirm that inputs are running, network traffic is being received, and messages are processed correctly.

Because log ingestion depends on network connectivity, port configuration, message format, and API credentials, the Input Diagnosis page provides a central place to identify and resolve issues.

This article describes the Input Diagnosis page, its key features, and best practices for troubleshooting input problems.

Input Diagnosis Page Overview

After launching an input, use the Input Diagnosis page to verify that it started correctly.

The Information panel displays key details about the input, including its title, type, running nodes, bind address, port, and traffic type. Review this summary first; incorrect values here usually indicate a configuration issue.

The State section shows whether the input is active on each node. If a failure occurs, Graylog lists the affected nodes and provides an error message. For example, the error bind(..) failed: Cannot assign requested address indicates that the specified IP address does not exist on the host or that another process is using the port.

The right-hand panel includes built-in troubleshooting guidance. Common causes of input failures include privileged ports (below 1024), unreachable IP addresses, missing network access for API-based inputs, or expired TLS certificates. Use these hints to quickly identify and correct configuration issues.

For example, if Graylog reports Cannot assign requested address for bind address 99.6.233.36 on port 5555, verify that the IP exists on the host and that no other service is using the port. Adjusting the address or port typically resolves the problem.

The table below lists common error messages and their recommended fixes.

Error Message	Likely Cause	Recommended Fix
`Cannot assign requested address`	IP address is invalid or not bound to the host interface.	Verify that the configured IP exists on the host and matches an active network interface.
`Address already in use`	Another process or input is already bound to the same port	Stop the conflicting service or configure the input to use a different port.
`Permission denied`	Attempt to bind to a privileged port (<1024) without root	Use a port above 1024 or run Graylog with the required privileges.
`Connection refused`	Input cannot connect to an external API endpoint	Check network/firewall rules, endpoint availability, and connectivity settings.
`Invalid or expired certificate`	TLS/SSL certificate is misconfigured, expired, or invalid	Renew or replace the certificate and update the input configuration.
No route to host	Networking issue preventing communication with target address	Verify routing tables, DNS resolution, and ensure network connectivity.

Now let’s tie these error messages directly to what you see on the Input Diagnosis page:

Received Traffic

If the input is running on all nodes but messages are not reaching it, your first stop should be the Received Traffic panel. The Network I/O field here shows whether traffic is arriving.

If no traffic appears, that’s a strong indicator of a connectivity problem.
At that point, try tools like ping, telnet, or tracert / traceroute to verify reachability and confirm that the correct port is open.
If the Input connects to an external API, check the server.log for authentication failures, invalid credentials or insufficient permissions.

Message Errors

If traffic is showing in the Network I/O field but no messages are received, it usually means the messages are not in a format the Input understands. Some causes may include:

TCP inputs receiving UDP traffic (mismatch of protocols).
Empty messages (they are discarded, and incremented under the Empty Messages discarded field).
Inputs that only support certain formats.

If you are unsure, use the raw/plaintext input, since it has the broadest compatibility for testing.

Errors During Processing/Failures to Index

If the input is running and messages are reaching it, but some or all messages are showing as errors, then head over to the Message Errors panel. This section breaks errors into three categories:

Errors at the input stage.

Failures during processing.

Failures to index in the search cluster.

This categorization allows you to identify the exact source of the error. Messages that fail to index at each of the above listed categories can be stored by Graylog and inspected (including the reason for the failures) by selecting the number if this option is enabled.

Received Message Count by Stream

The Received Message count by Stream section details the message counts; here you can inspect individual failures and dig deeper into what went wrong by clicking on Show received messages .

Best Practices

To ensure the most accurate results when using Input Diagnosis:

Verify bind addresses and ports before creating an input.
Avoid overlapping configurations that may cause resource conflicts.
Use higher port numbers to prevent privilege-related issues.
Monitor TLS certificate validity and expiration dates.
Review the server.log for detailed error messages when troubleshooting.

The Input Diagnosis page serves as more than a basic health check. It provides a proactive method to confirm input functionality before log data enters the pipeline. By combining the informational overview, real-time status checks, built-in troubleshooting guidance, and manual validation, administrators can identify and correct configuration issues efficiently, ensuring a stable and reliable Graylog environment.