Bare with me, this is a confusing one and my knowledge of Graylog is limited.
I am still struggling to get a clone of my Graylog system running in a virtual environment so I can practice upgrading it from 2.3 to 3.0. This is my previous post about this, which is locked now due to inactivity:
Quick summary: my new virtual machine clone runs perfectly, almost too perfectly: it behaves exactly like the old server including the fact it appears to receiving 500+ messages/sec same as the old server - which is absolutely bizarre and simply is not possible
Every config file (server.conf and elasticsearch.yml) has been scoured to make sure the old IP address was replaced with the new clone IP address - there is no reason this new system should be connected to the old - I’ve even put in iptable entries so they cannot talk to each other directly. Yet the clone still appears to log all the same messages same as the original, it is very strange.
Note when I go to System/Nodes on the clone, it shows there is one active node, and it has the same code and hostname as my old node, ie: a002c9da / logs.mydomain.com , when in fact this machine is called logs-clone.mydomain.com.
I inherited this system and my knowledge is very limited, but I need to push this project forward. How do I break the connection between clone and original, can I rename the cloned node? Create a new node?