Graylog cluster with multiple ethernet interfaces

[amendoza (Aitor Mendoza)]

First of all a greeting to this community, I write for the first time in this new forum.

I have Graylog in cluster with a master node that receives and distributes the logs and has the web interface as well and two elastic nodes that store the data in duplicate.

The thing is that until now I had everything running perfectly in the 192.168.1.0 subnet but now I want to add a network card to the main server, and move all 3 servers to the 192.168.50.0 subnet but keeping the log entry for 192.168.1.0

I show it in a graphic to make it clearer:

I do not know how to make the network configuration / graylog / elastic so that it works as I want.
I have tried to add a card and configure it as follows:
eth0: 192.168.1.1/24
eth1: 192.168.50.1/24
gw: 192.168.50.254

But it does not answer me for both networks and graylog does not work correctly.

Any idea what steps to follow? In summary, I want to keep the cluster (triangle of the 3 servers) by the subnet 192.168.50.0 but that the reception of logs and communication of the collectors continues to be for the 192.168.1.0

Thanks and best regards!

[jochen]

Configure Graylog to listen on the 192.168.1.0/24 network (rest_listen_uri, web_listen_uri, and related settings) and to connect to Elasticsearch on the 192.168.50.0/24 network (elasticsearch_hosts).

Also check out the documentation for details:

• http://docs.graylog.org/en/2.4/pages/configuration/web_interface.html
• http://docs.graylog.org/en/2.4/pages/configuration/elasticsearch.html