Can graylog present different views to different users?


Can graylog present different views to different users? such as user A can only see messages from input 1, while user B can only see messages from input 2? What’s the best way to accomplish this goal?


Under System/Authentication you can set up Roles. With Roles you can set what streams or dashboard your users have access to (read/edit). Then just give roles to your users and you should be set.

One thing I do in my setup is to make a stream per input. Single rule of “gl2_source_input must match exactly [input_id]”. That will give you the chance to give users access to your inputs so to speak.

@sgarciam Awesome! Thanks a lot!!

@sgarciam how to find out what the input_id is? :grinning:

You could click on “Show received messages” on the System / Inputs page. This will generate a search query which contains the correct input ID.

@jochen Thanks! yeah I just figured that one out through comparing URL :slight_smile: Now I created a stream with “gl2_source_input must match exactly [input_id]”, but when I click on said stream, no messages showed up. I made sure the input does have messages coming in. Is there anything I am missing?

@jochen nevermind, I figured it out! Thanks!

For the record, just new messages will be assigned to the new stream. Existing messages from that input will not appear in the newly created stream.

@jochen Got it! Thanks a lot!!

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.