Configure graylog global input with 2 nodes

Graylog Central (peer support)
1

I have Graylog installed in 2 nodes. Both part of a replica set in Azure behind a load balancer.
I access site with: http://publicip:9000. So far just for testing I have been configuring only local inputs on node A as is marked as master. So from Source server with fluentd I configured a input like following and log are being sent and received in graylog with no problems:

<store>
type GELF
host 10.0.1.2 (node A ip)
port 12225
</store>

then configured local input in graylog, start the inputs and I´m seeying logs from source server.

Now I want configure a global input. How is the configuration for this i the source server? Should I just put hole path of input like in graylog portal? “40.25.x.x:/9000/system/input” like this? should I also configure a random port in graylog? What should be the fluentd config on source server to send traffic to global input? like follow?

type GELF
host: 40.25.x.x:9000/system/input ?
port: 12300

I wasn´t able to find a way quite clear to do this in graylog documentation as It only indicates with local input should

thanks!

2

how you act in a multi node setup highly depends on your setup and your configuration. In addition to your needs.

You might want to have a loadbalancer placed before your two Graylog server that does some kind of health check on the Graylog Input and forward messages only to the server that is up and running.

Or you collector is able to forward messages to two inputs than the LB is not needed.

The next option is that you have a floating IP on your Graylog servers and you just configure that at the collector.

You can’t give a “follow this path” answer on that topic.

3

hmm yes as I said I already have a load balancer IP before the 2 nodes up and running. Now, how and where should I configure this that you are saying? : You might want to have a loadbalancer placed before your two Graylog server that does some kind of health check on the Graylog Input and forward messages only to the server that is up and running.

4

you need to configure that in your loadbalancer …

5

what do you mean? load balancer is a service running in Azure with public IP and already configure to route traffic to either node A and node B. Is there any other config needed from graylog side?

6

you have configured a global input in your Graylog? Lets say GELF TCP on one port? You have configured your Azure Loadbalancer to forward TCP connections on a specific port to the port of your Graylog servers where the input is running?

You are ready to go and send messages from anywhere to your loadbalancer on that specific port and it will be routed to one of your Graylog servers.

7

that´s again my first question of the post. You said You are ready to go and send messages from anywhere to your loadbalancer, so should I configure output on source server to graylog like this?

type GELF
host: 40.25.x.x:9000/system/input ?
port: 12300

8

I configured like follow in source but not receiving any message on input:

<match tomcat.*.log>
type copy
buffer_type memory
buffer_chunk_limit 256m
buffer_queue_limit 128
flush_interval 1s
disable_retry_limit false
retry_limit 17
retry_wait 1s

type gelf
host 45.12.13.34:9000/system/input
port 12232


type stdout

gelf
gelf1886×242 28 KB

9

you should really step-back and think what you have configured.

is 45.12.13.34:9000/system/input really the IP of your loadbalancer? I bet that it is 45.12.13.34

That is networking and linux basic knowledge.

10

of course is not the IP the hole path, but just wondering because I´ve seen in other posts that apart from the IP it´s also added the input path.

11

without reference to that postings - it might be that those persons use the http gelf input …

12

Probably. thanks for your help.

13

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.