We are currently migrating to the new 3.0 graylog-sidecar and testing a reasonable way to handle to configuration/collector design. As the previous sidecar used to fetch the configuration based on tags which isn’t the case anymore we are not entirely sure how to create a similar design. The most important thing we need is a custom field with the customer name in it for each log message received by that customer.
Has anyone some design experience which he may share? Do you create one collector e.g winlogbeat and one config per node? Is there a way to send these custom fields via node like it was done before with tags?
We’d appreciate some thoughts on how you handle the sidecar configurations.