Graylog as Secondary Log Storage

Graylog Central (peer support)
1

Hey All,

I’m researching whether it is possible to have sidecar or graylog save a copy of the raw message stream to a local disk. The idea is to have various sources using sidecar and syslog push to either a middle log depot machine which will store the logs to a longer retention than is possible on the application boxes and then from there push to graylog/ES for indexing and searching. I know that syslog can save a copy of anything it receives from a TCP/UDP input. Can sidecar be configured in the same way? If not, can graylog be configured to save the messages coming in in the original format?

2

You can probably configure the actual log shipper which collects and sends log messages to Graylog, but the Collector Sidecar itself doesn’t read any log messages.

3

When you say log shipper, you don’t mean collector sidecar? Are you more referring to something like logstash?

4

Correct. The Graylog Collector Sidecar merely configures and starts/stops a log shipper such as Filebeat or NXLOG.

See http://docs.graylog.org/en/2.4/pages/collector_sidecar.html for details.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.