Graylog UI Freezes When Editing Queries – Ingest and Performance Impacted

Expected Behavior

When filtering logs in the UI, the entire browser tab can occasionally freeze. During this freeze, no logs are ingested into the system, and the UI becomes unresponsive. It looks like Graylog itself is hanging.

Once the frozen browser tab is closed, Graylog resumes normal operation: the UI becomes responsive, and logs from the journal are processed and indexed in OpenSearch again.

The issue most often happens when editing queries—especially longer ones, or those that include IP address ranges—using the keyboard or via copy & paste.

Example query that triggered the issue:

(fp_Src:"192.168.100.0/24" OR fp_Src:"203.0.113.45") AND fp_Dport:(25 OR 465 OR 587)
Editing this query (e.g. in the middle) can lead to the described behavior.

I will try to record a video to demonstrate the issue, but it happens sporadically.

Current Behavior

When a query causes the tab to hang, the entire Graylog UI becomes unusable and the log ingestion stops. Logs collect in the journal but are not indexed in OpenSearch until the tab is closed.

Possible Solution

Steps to Reproduce (for bugs)

The error occurs sporadically and can be hard to reproduce. Sometimes everything works for hours, then suddenly the issue appears after a few edits.

Steps:

Open Graylog web interface.

Enter a more complex search query.

Edit the query manually, e.g. in the middle or by copying/pasting.

Observe if the browser tab freezes and UI stops responding.

Context

When this error occurs, the entire cluster becomes unusable for users. No logs are processed, and system performance is degraded. Logs pile up in the journal, and users cannot view or search data until the frozen tab is closed.

Ideally, an error in query parsing or the search component should not affect the entire UI or block log ingestion. These systems should be decoupled to prevent a UI issue from impacting the backend.

When I can provide additional information, please let me know.
Also, how can I debug this issue to get some useful logs? That would help as well.

Your Environment

Graylog Cluster with 3 nodes behind a load balancer (nginx), connected to a 7-node OpenSearch cluster (5 data nodes)

Graylog Version: Docker graylog/graylog:6.3.1

Java Version: Java version included in Graylog Docker image

OpenSearch Version: opensearch:2.12.0

MongoDB Version: mongodb/mongodb-community-server:6.0-ubi8 (3-node replica set)

Operating System: Ubuntu 22.04

Browser Versions: Tested in latest versions of Chrome, Chromium, Brave, Firefox, and Opera