Hello Graylog Community,
I have been working diligently over the past several weeks trying to stand up two Graylog servers on CentOS7 boxes in our VM environment. Everything has gone relatively smoothly, except for when it comes to modifying the Graylog Default Index Set.
My problem is that I built out one of the servers, got it configured to my liking, and then cloned the VM. When I stood up the second one, I now have two Graylog servers with the same naming convention for the Default Index Set prefix. Ideally, I wanted to be able to assign a different prefix to default index.
I have tried changing the prefix in the /etc/graylog/server/server.conf, ElasticSearch settings section, but it seems to just be ignoring that change when I restart the services and ask it to rotate or rebuild the index.
Additionally, I’ve also created a new index directly within Graylog WEB and assigned it the role of ‘Default Index’, but the server still seems to ignore this and continues to write to the original Default Index Set.
I tried to close the default index, rotate it, point the All messages stream to the new index, all to no avail.
I read the articles outlined by Graylog on the Index and Stream model here:
No where does it really talk about changing this default index set— but if it isn’t possible, then why give us the option of setting another index as the ‘Default’ within the Web GUI? Is this still just a work in progress, or is there something that I’m missing in order to get it to actually use the new index?
Any help that you lovely folks could provide would be greatly welcomed.