This works well for me.
I need to give a bunch of staff read access to everything in Graylog, so I
have created a stream "CatchAll" with the rule simply that the message
field is present.
I then grant the necessary users view access on the CatchAll stream and it
seems to work well.
The only c
Hi Mark,
you can create a stream containing all messages (e. g. by checking for the
presence of the timestamp or message fields) and allow all users to read
that stream (but not edit it). This way users can query for all messages
(in that stream) but cannot modify anything.
Cheers,
Jochen
On
ALL messages are relevant to every user. And unless I don't have a firm
grasp of Streams, I found that option unacceptable. So I set up a second VM
with full search but no way to mess with the archived data or delete inputs
by mistake.
On Tuesday, June 16, 2015 at 1:18:53 AM UTC-7, Jochen Scha
Hi Mark,
you could probably create read-only users and assign them to a stream with
messages relevant to them.
Cheers,
Jochen
On Monday, 15 June 2015 21:28:01 UTC+2, Mark Moorcroft wrote:
>
>
> And if I could link to the "master" mongoDB then obviously that would
> defeat the point of giving s
And if I could link to the "master" mongoDB then obviously that would
defeat the point of giving search ability to users without making them an
admin on the master?
On Monday, June 15, 2015 at 6:17:23 AM UTC-7, Jochen Schalanda wrote:
>
> Hi Mark,
>
> input configurations are being stored insi
Hi Mark,
input configurations are being stored inside MongoDB and are linked to the
node ID. If your "slave" Graylog instance is either using another node ID
or isn't able to access the MongoDB with the input configurations, you'll
see the message ("deleted input on outdated node") in the web i
