Thanks, Jochen, I perhaps didn't make myself clear in my question - I have a number of Graylog collectors running on different instances and my question was more whether I should create a separate input on a distinct port for each of these collectors or just create one input and have all the collectors send to that one input.
In the end, I went with the second approach, so I have one GELF TCP input started on port 12201, which aggregates the data from all the collectors. I then have created a number of streams to route the incoming data, where they can be separated by log (and application) type. I preferred this approach as it meant from a security point of view, I only had to open one more port and the 'Streams' concept allowed me to segment my log messages. Seán On Tuesday, 1 December 2015 16:41:40 UTC, Sean McGurk wrote: > > Hi there, > > I have set up a Graylog server with a number (7) of input sources. > > My question is, when configuring Graylog, is it better to open a number of > ports on the Graylog server and have each port receive messages from a > particular source or is it better to only open 1 port and receive all > inputs via this 1 port? > > Thanks, > > Seán > > > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/7c662b78-65ee-4eb0-8186-551b63147d5f%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
