We are trying to delete old configurations in a Sidecar that we are not using anymore, but we can’t.
The explaining: we started using Filebeat to collect Windows DNS Server logs, after that tried NXLog without success (the im_etw module is unavailable in the Community Edition), and finally we decide to use Winlogbeat, collecting from a special Event Viewer Channel that we made using SilkETW (https://github.com/fireeye/SilkETW).
The problem is now, we want to delete Filebeat configuration and NXLog configuration from this Sidecar, and only stay with Winlogbeat configuration, but we can’t, because we cannot delete them from the “Collectors Administration” (we cannot found “delete” there), and we cannot delete directly the “Collectors Configuration” for Filebeat and NXLog, because Graylog say “Deleting Configuration failed: Configuration still in use, cannot delete.”
Hi there,
I have the same situation here.
A sidecar with configuration for filebeat and nxlog which is no longer installed.
Cannot delete configuration for nxlog because it is in use.
And can not delete the use on a sidecar - at least I can not find a way.
(Graylog Server 3.2.4-1)
Hi
I think we have the same issue, nxlog sidecar config cannot be removed because it is in use but there is no way to de-select / remove a config on the sidecar overview.
Graylog 3.2.3
edit: creating a new config and changing all entries to the new config, the old one can now be removed. It seems the issue is a config can only be changed but not removed
An update: maybe what is not working is the “Expiration threshold” setting in the “Update Sidecars System Configuration”, because after 14 days, which is the default expiration threshold for the Sidecars, I succesfully deleted old Sidecar configurations not used by any configured Sidecar, finally Graylog interface allow me to do it.
