We are trying to delete old configurations in a Sidecar that we are not using anymore, but we can’t.
The explaining: we started using Filebeat to collect Windows DNS Server logs, after that tried NXLog without success (the im_etw module is unavailable in the Community Edition), and finally we decide to use Winlogbeat, collecting from a special Event Viewer Channel that we made using SilkETW (https://github.com/fireeye/SilkETW).
The problem is now, we want to delete Filebeat configuration and NXLog configuration from this Sidecar, and only stay with Winlogbeat configuration, but we can’t, because we cannot delete them from the “Collectors Administration” (we cannot found “delete” there), and we cannot delete directly the “Collectors Configuration” for Filebeat and NXLog, because Graylog say “Deleting Configuration failed: Configuration still in use, cannot delete.”
It’s not working also after I reinstall the Sidecar on the Server, and config Graylog to purge from database inactive Sidecars after five minutes:
Anyone in the same situation?
Graylog version 3.2.4.