[graylog2] Does sidecar/filebeat support recursive subfolders specified by '*'

Does sidecar/filebeat support recursive subfolders specified by '*'? I mean if we have structure /var/log/dir1/dir2/ and /var/log/dir1/ and specify log pattern in collector input like /var/log/dir1/* then will the logs2 files from /var/log/dir1/dir2/ be collected? Thanks, Eugene -- You

[graylog2] Re: Split message without drools

and there is a simple way to use extractor produced data in pipeline? Eugene On Tuesday, January 10, 2017 at 4:01:57 PM UTC-8, Evgueni Gordienko wrote: > > I us 2.1.2 GL and need to split message by spaces and then split second > item in result by '='. > I can not find split in my r

[graylog2] Split message without drools

I us 2.1.2 GL and need to split message by spaces and then split second item in result by '='. I can not find split in my release of GL. I can write Drools rule for that but is it possible to do it without Drools? Eugene -- You received this message because you are subscribed to the Google

[graylog2] Combining pipeline and output

For my stream in pipeline I have customized function which creates message in format acceptable by upstream server (Influx), I am working custom plugin similar to Splunk output plugin to create customised TCP output. But how can I make output of my function in pipeline be forwarded to that

[graylog2] Export and import dashboard

I have created dashboard on one of my GL servers for domain 1, would like to have same dashboard for my GL server in domain2. Is it possible to export dashboard settings and import them into another GL server? Thanks, Eugene -- You received this message because you are subscribed to the

[graylog2] Single or double quotes in json messages for configuration via api

Hi, When I curl with GET method on collector config info I get "paths" : "[\"/var/log/*.log\",\"/var/log/messages\",\"/var/log/secure\"]" So which form is correct in POST for configuration: "properties": { "paths": "['/var/log/*.log','/var/log/messages']", or "properties": {

[graylog2] Re: 'API Browser' button does not work with no DNS and https enabled in cluster

, producing 220 keys and 893 values On Wednesday, November 2, 2016 at 8:01:50 PM UTC-7, Evgueni Gordienko wrote: > > Hi, > I have 2 node GL cluster - each node has 2 NICs and https is enabled. > The doc from > http://docs.graylog.org/en/2.1/pages/configuration/rest_api.html says:

[graylog2] 'API Browser' button does not work with no DNS and https enabled in cluster

Hi, I have 2 node GL cluster - each node has 2 NICs and https is enabled. The doc from http://docs.graylog.org/en/2.1/pages/configuration/rest_api.html says: 'For example if your Graylog REST API is listening on http://192.168.178.26:9000/api/, the API browser will be available at

[graylog2] Monitoring Graylog pipeline - what is suggested?

Hi, What tool/good-practice would be suggested to monitor Graylog pipeline itself? I mean pipeline: filebeat+sidecar->Graylog cluster+Mongo->Elasticsearch. Thanks, evgueni -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from

[graylog2] Re: Unreadable or missing REST API private key

- what could be wrong? Cheers Evgueni On Sunday, October 16, 2016 at 11:24:36 PM UTC-7, Jochen Schalanda wrote: > > Hi Evgueni, > > On Friday, 14 October 2016 22:32:58 UTC+2, Evgueni Gordienko wrote: >> >> I enabled tls and the file graylog complains about is there and h

[graylog2] Re: Unreadable or missing REST API private key

UTC-7, Evgueni Gordienko wrote: > > Hi, > > I enabled tls and the file graylog complains about is there and hase 0777 > permissions set but still I get: > ERROR [CmdLineTool] Invalid configuration > com.github.joschi.jadconfig.ValidationException: Unreadable or missing > RE

[graylog2] Unreadable or missing REST API private key

Hi, I enabled tls and the file graylog complains about is there and hase 0777 permissions set but still I get: ERROR [CmdLineTool] Invalid configuration com.github.joschi.jadconfig.ValidationException: Unreadable or missing REST API private key: /etc/graylog/secrets/pkcs8-encrypted.pem at

[graylog2] Re: Meaning of graylog_elasticsearch_discovery_zen_ping_unicast_hosts

is used to create server/elasticsearch.yml What is correct setting - say I have ES servers and GL servers and all have separate ip? Thanks, Evgueni On Friday, October 7, 2016 at 11:39:19 AM UTC-7, Evgueni Gordienko wrote: > > Hi, > > I have GL(2 nodes) + ES(3 nodes) cluster. > What

[graylog2] Re: Meaning of graylog_elasticsearch_discovery_zen_ping_unicast_hosts

ervers (in my case 2 GL servers) but how? I also guess that improper setting of this patameter leads to having master issue - in my case each of my two GL servers acts as a master and it is reported in GL cluster GUI. Thanks, Evgueni On Friday, October 7, 2016 at 11:39:19 AM UTC-7, Evgueni Gordienko

[graylog2] Meaning of graylog_elasticsearch_discovery_zen_ping_unicast_hosts

Hi, I have GL(2 nodes) + ES(3 nodes) cluster. What is the meaning of graylog_elasticsearch_discovery_zen_ping_unicast_hosts setting? Thanks, Evgueni -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop

[graylog2] How to set additional fields for sidecar/filebeat

While configuring 'Configure Beats Input' there is a possibility to add additional field. I tried to set bulk_max_size equal to 8192 but it looks like it does not make any effect - I couldn't find it in any config file. In general - how to set additional fields for sidecar/filebeat? Thanks,

[graylog2] Reference Configuration with Graylog

Hi All, Is there any suggested/reference configuration with Graylog which does not have single point of failure? Thanks, Evgueni -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from

[graylog2] Do I have to uninstall filebeat for collector-sidecar installation?

Hi All, I have filebeat running on my client and need to install sidecar. The yum installation results: Transaction check error: file /usr/bin/filebeat from install of collector-sidecar-0.0.9-1.x86_64 conflicts with file from package filebeat-1.3.1-1.x86_64 Should I uninstall filebeat first?