{"action":"created","issue":{"url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/1125","labels_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/1125/labels{/name}","comments_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/1125/comments","events_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/1125/events","html_url":"https://github.com/Graylog2/graylog2-server/issues/1125","id":70181252,"number":1125,"title":"400 Bad Request when searching in Graylog","user":{"login":"sidcarter","id":72859,"avatar_url":"https://avatars.githubusercontent.com/u/72859?v=3","gravatar_id":"","url":"https://api.github.com/users/sidcarter","html_url":"https://github.com/sidcarter","followers_url":"https://api.github.com/users/sidcarter/followers","following_url":"https://api.github.com/users/sidcarter/following{/other_user}","gists_url":"https://api.github.com/users/sidcarter/gists{/gist_id}","starred_url":"https://api.github.com/users/sidcarter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sidcarter/subscriptions","organizations_url":"https://api.github.com/users/sidcarter/orgs","repos_url":"https://api.github.com/users/sidcarter/repos","events_url":"https://api.github.com/users/sidcarter/events{/privacy}","received_events_url":"https://api.github.com/users/sidcarter/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-04-22T17:05:10Z","updated_at":"2015-04-22T17:09:17Z","closed_at":null,"body":"I have a dashboard for monitoring alerts, counts etc., One of the stats was showing an error, so I went and did a manual search.\r\n\r\nWhen doing a search that I do often, (which I also use to populate the dashboard), I get a \r\n\r\n400: Bad Request error.\r\n\r\nIn the logs I see this around the time when i did the search:\r\n\r\n2015-04-22 16:49:47,059 WARN : org.elasticsearch.transport.netty - [graylog2-server-graylog2-1e] M\r\nessage not fully read (response) for [995122] handler org.elasticsearch.search.action.SearchServic\r\neTransportAction$6@747b9807, error [true], resetting\r\n2015-04-22 16:49:47,077 WARN : org.elasticsearch.transport.netty - [graylog2-server-graylog2-1e] M\r\nessage not fully read (response) for [995121] handler org.elasticsearch.search.action.SearchServic\r\neTransportAction$6@44953c28, error [true], resetting\r\n2015-04-22 16:49:47,086 WARN : org.elasticsearch.transport.netty - [graylog2-server-graylog2-1e] M\r\nessage not fully read (response) for [995120] handler org.elasticsearch.search.action.SearchServic\r\neTransportAction$6@7c3fec4f, error [true], resetting\r\n2015-04-22 16:49:47,086 ERROR: org.graylog2.periodical.AlertScannerThread - Skipping alert check t\r\nhat threw an exception.\r\norg.elasticsearch.action.search.SearchPhaseExecutionException: Failed to execute phase [query], al\r\nl shards failed; shardFailures {[K4KPapb5SWWG4Dcjf6RmZA][graylog2_1502][0]: RemoteTransportExcepti\r\non[Failed to deserialize exception response from stream]; nested: TransportSerializationException[\r\nFailed to deserialize exception response from stream]; nested: StreamCorruptedException[invalid ty\r\npe code: 00]; }{[xMrPAIhRTMuBpg7Pylf4Mg][graylog2_1502][1]: RemoteTransportException[Failed to des\r\nerialize exception response from stream]; nested: TransportSerializationException[Failed to deseri\r\nalize exception response from stream]; nested: StreamCorruptedException[invalid type code: 00]; }{\r\n[qb_Iw7S0QDy75jo4PQgYCQ][graylog2_1502][2]: RemoteTransportException[Failed to deserialize excepti\r\non response from stream]; nested: TransportSerializationException[Failed to deserialize exception\r\nresponse from stream]; nested: StreamCorruptedException[invalid type code: 00]; }{[AKSaa51jSbi_vWA\r\nlTXd7Bg][graylog2_1502][3]: RemoteTransportException[Failed to deserialize exception response from\r\n stream]; nested: TransportSerializationException[Failed to deserialize exception response from st\r\nream]; nested: StreamCorruptedException[invalid type code: 00]; }\r\n        at org.elasticsearch.action.search.type.TransportSearchTypeAction$BaseAsyncAction.onFirstP\r\nhaseResult(TransportSearchTypeAction.java:232)\r\n        at org.elasticsearch.action.search.type.TransportSearchTypeAction$BaseAsyncAction$1.onFail\r\nure(TransportSearchTypeAction.java:178)\r\n        at org.elasticsearch.search.action.SearchServiceTransportAction$6.handleException(SearchSe\r\nrviceTransportAction.java:224)\r\n        at org.elasticsearch.transport.netty.MessageChannelHandler.handleException(MessageChannelH\r\nandler.java:185)"},"comment":{"url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/comments/95267080","html_url":"https://github.com/Graylog2/graylog2-server/issues/1125#issuecomment-95267080","issue_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/1125","id":95267080,"user":{"login":"sidcarter","id":72859,"avatar_url":"https://avatars.githubusercontent.com/u/72859?v=3","gravatar_id":"","url":"https://api.github.com/users/sidcarter","html_url":"https://github.com/sidcarter","followers_url":"https://api.github.com/users/sidcarter/followers","following_url":"https://api.github.com/users/sidcarter/following{/other_user}","gists_url":"https://api.github.com/users/sidcarter/gists{/gist_id}","starred_url":"https://api.github.com/users/sidcarter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sidcarter/subscriptions","organizations_url":"https://api.github.com/users/sidcarter/orgs","repos_url":"https://api.github.com/users/sidcarter/repos","events_url":"https://api.github.com/users/sidcarter/events{/privacy}","received_events_url":"https://api.github.com/users/sidcarter/received_events","type":"User","site_admin":false},"created_at":"2015-04-22T17:09:17Z","updated_at":"2015-04-22T17:09:17Z","body":"Also, this fails silently. Until I check the dashboard and do a search, I have no way of knowing that these searches are failing.\r\n\r\nA restart appears to have fixed the issue for now."}}