Re: [graylog2] Re: New to Graylog and Elasticsearch; have some questions

2016-12-14 Thread Joshua Waclawski
This is the answer I needed, thank you. I used those images fully thinking they were just base installs of all of the modules required (mongo, elastisearch, nginx), I didn't know functionality was removed to reduce complexity. Looks like I'll be setting up a custom installation then so I can

Re: [graylog2] Re: New to Graylog and Elasticsearch; have some questions

2016-12-13 Thread Marius Sturm
Hi Joshua, on the appliances MongoDB runs without a configuration file. Settings are given by command line options. If you want to change something you can add or delete options in the start script of MongoDB: /opt/graylog/service/mongodb/run Afterwards restart the service. I think your confusion

Re: [graylog2] Re: New to Graylog and Elasticsearch; have some questions

2016-12-13 Thread Joshua Waclawski
Hey Jochen, Looks like you may be at least partially correct, my apologies for the confusion on this. That section does point to most of the configuration files, I still need access to change configurations of MongoDB to close up some pretty problematic security holes. That documentation is t

Re: [graylog2] Re: New to Graylog and Elasticsearch; have some questions

2016-12-11 Thread Jochen Schalanda
Hi Joshua, On Saturday, 10 December 2016 19:27:40 UTC+1, Joshua Waclawski wrote: > > As I mentioned in my previous post, that documentation is incorrect when > using the EC2-AMI's provided on the graylog website. Here's some examples... > I think you've been looking at the wrong section of the d

Re: [graylog2] Re: New to Graylog and Elasticsearch; have some questions

2016-12-10 Thread Joshua Waclawski
Hey Jochen, As I mentioned in my previous post, that documentation is incorrect when using the EC2-AMI's provided on the graylog website. Here's some examples... 1. Graylog is installed to /opt instead of /etc. I've tried checking that directory for several files that are listed in the

Re: [graylog2] Re: New to Graylog and Elasticsearch; have some questions

2016-12-09 Thread Jochen Schalanda
Hi Joshua, On Thursday, 8 December 2016 20:29:48 UTC+1, Joshua Waclawski wrote: > > I can definitely do that. While I'm doing that, would you be able to > assist me otherwise by helping to locate the configuration files for each > of the services? > See http://docs.graylog.org/en/2.1/pages/con

Re: [graylog2] Re: New to Graylog and Elasticsearch; have some questions

2016-12-08 Thread Werner vd Merwe
Hi Joshua, I use Puppet, so not managing config files myself. To my knowledge though, server.conf for Graylog and mongo[sd].conf is the only non ES config files. > On 9/12/2016, at 08:29, Joshua Waclawski wrote: > > I can definitely do that. While I'm doing that, would you be able to assist

Re: [graylog2] Re: New to Graylog and Elasticsearch; have some questions

2016-12-08 Thread Joshua Waclawski
I can definitely do that. While I'm doing that, would you be able to assist me otherwise by helping to locate the configuration files for each of the services? On Thursday, December 8, 2016 at 2:16:37 PM UTC-5, Werner van der Merwe wrote: > > Hi Joshua, > > I am going to have to make a few a

Re: [graylog2] Re: New to Graylog and Elasticsearch; have some questions

2016-12-08 Thread Werner vd Merwe
Hi Joshua, I am going to have to make a few assumptions here. The fact that your ES cluster is red will directly result in your journal filling up. Graylog will journal all the messages until ES appears green before it sends the messages. I'd focus my time on looking through the ES logs for in

[graylog2] Re: New to Graylog and Elasticsearch; have some questions

2016-12-08 Thread Joshua Waclawski
Hello Werner, Thanks for the reply and I apologize for the long delay, my project was shelved briefly to handle some new work. With that out of the way I can get back into this project... Well to start out, my graylog server crashes almost weekly due to the application running out of some sor

[graylog2] Re: New to Graylog and Elasticsearch; have some questions

2016-11-21 Thread Werner van der Merwe
Ahh, if you want to go HA, you can use their tool to get estimates: https://www.graylog.org/tools/sizing-estimator On Friday, November 18, 2016 at 5:50:17 AM UTC+13, Joshua Waclawski wrote: > > As the title states, I'm pretty new to Graylog and Elasticsearch. I've > read the documentation thor

[graylog2] Re: New to Graylog and Elasticsearch; have some questions

2016-11-21 Thread Werner van der Merwe
Hi Joshua, Hardware requirements: It is obviously very difficult to give you exact numbers. The requirements for 300 syslog messages vs 300 multi-line logs where one extracts 50 key value pairs per entry will have different requirements. That said, 300 messages is trivial and you can get away w