Re: [graylog2] Re: Design question concerning Inputs

2014-12-16 Thread Troy
Kay, If I have an input that has say 10-15 base extractors and I want to break it into separate inputs to tag the sources as you mentioned, so we would be duplicating the extractors across multiple inputs. Does the duplicate extractor processing add substantial overhead? In general, what is

Re: [graylog2] Re: Design question concerning Inputs

2014-07-31 Thread Arie
thx Kay, great answer, the logic that I was looking for :-). A. On Thursday, July 31, 2014 1:47:57 AM UTC+2, Kay Röpke wrote: Hi! Generally speaking: If your log senders need special treatment (i.e. if you need to set up different extractors), then use different inputs. If you send

[graylog2] Re: Design question concerning Inputs

2014-07-30 Thread Denny Gebel
Hi Arie, how did you set up your configuration? One input for everything or did you seperate anything? Denny Am Mittwoch, 2. Juli 2014 16:08:25 UTC+2 schrieb Arie: Hi all, I am working on our production cluster. We want to get log-files from different systems with different

Re: [graylog2] Re: Design question concerning Inputs

2014-07-30 Thread Kay Röpke
Hi! Generally speaking: If your log senders need special treatment (i.e. if you need to set up different extractors), then use different inputs. If you send gelf directly, you are generally ok with one input. Syslog-like inputs often need special extractors, so in those cases you have special