Hi, we are a small company who monitor operational network environments, however we do not have the resources for the Enterprise 5/10Gb license.
OS Information: Ubuntu x64
Package Version: Enterprise 4.2.5-1
Does using a Graylog forwarder allow you to filter logs before sending them to the Graylog server? If so, would the logs you are filtering out (not sending to the server) from the forwarder be counted towards your daily traffic limit?
Has anyone tried to setup a Graylog open source server as a filter/feeder for the enterprise version, to reduce the number of incoming logs?
Any insight into this matter would be greatly appreciated.
Hi Linedo,
the accounted messages are the ones, which are written into the Opensearch/Elastic database after all processing. If you have messages which are not relevant at all you can delete them in a pipeline. Those will not reach the database and thus not be counted.
Hi, thanks for your response! I didn’t realise that messages processed by the pipelines don’t count towards the daily traffic limit, that’s really helpful to know and I will look into creating filtering pipelines tomorrow. Thanks again for your help!
