Collector sidecar monitoring and index error rotation

[rfinney]

I have a few separate questions I’ve been wondering about.

First, is it possible within Graylog to monitor collector sidecars and alert if they are disconnected or haven’t received a message from one in x amount of time?

Or is it possible to alert based on not receiveing a message from host x in x amount of time globally regardless of stream?

Second, occasionally one of my indexes that recieves logs from winlogbeat will rotate and assign the wrong things from the first message received. This causes a ton of index errors until the index is rotated again. Is it possible to auto rotate the index if x amount of errors are present?

[jochen]

Is it possible to auto rotate the index if x amount of errors are present?

No, but you should create a custom index mapping for these messages to avoid indexing errors when the dynamic mapping infers the incorrect type.

See http://docs.graylog.org/en/2.4/pages/configuration/elasticsearch.html#custom-index-mappings for details.

[rfinney]

Thanks Jochen. I’ll take a look.

[mattmatics (Matt)]

If you want to see collector notifications as a feature add some comments / likes here:

https://github.com/Graylog2/graylog2-server/issues/4580