Change location of log files to an external location - Please help

[fsociety3765]

Hi all,

New to the forum and also Graylog.

I have set up a single Graylog server on Ubuntu Server. The server OS only has a 20GB disk. I have been looking through the docs on how to set up an external storage location to store all log files but it’s not immediately clear to me. I must be overlooking it. I am now getting red warnings on the dashboard regarding disk space so really need to figure this out.

I have a TrueNAS server setup with plenty of storage and this is where I want to store all the logs. Whether that be via an SMB share, NFS share, iSCSI, or even S3.

I am sure this question must have come up before and I would really appreciate a pointer in the right direction.

Thanks,

FS

[reimlima (Dummy)]

Hi @fsociety3765 ,

@fsociety3765

I am now getting red warnings on the dashboard regarding disk space so really need to figure this out.

Those messages are related to Elasticsearch running out of space, about that you can find out how to configure it here.

@fsociety3765

I have a TrueNAS server setup with plenty of storage and this is where I want to store all the logs. Whether that be via an SMB share, NFS share, iSCSI, or even S3.

You can change your data path in your elasticsearch.yml to point to your network share but (personal opinion here), not sure if it’s the ideal scenario due to network latency, however it’s tottally up to you, based on your environment.