Graylog Mass import of inputs


(teris) #1

Hi, we run Graylog and we need to import massively hosts as we have around 2000 and manually will take ages. I searched around but nothing found.
Do you have any solution?
Thank you!


(Jochen) #2

What do you exactly mean with “import massively hosts”?

If you mean configuring your systems to send their logs to Graylog, that’s usually a job for configuration management systems such as Puppet, Chef, or Ansible.

Also take a look at the Graylog Collector Sidecar: http://docs.graylog.org/en/2.2/pages/collector_sidecar.html


(teris) #3

Hi I mean instead of going to graylog administration System/Inputs -> Inputs -> Launch New Input
to make it somehow automatically configured for 2000 inputs (clients)

:slight_smile:


(teris) #4

anyone pls to assist?


(Jochen) #5

Why would you do that? Most types of inputs can handle multiple clients.

“Bumping” topics after such a short time is considered rude.

If you need a specific SLA for your support requests, you’ll have to get enterprise support.


(Johan THOMAS) #7

Hi,
1 input can handle thousands of clients.
How did you configure your clients ?


(teris) #8

I might have it wrong via graylog web admin System/Inputs -> Inputs -> Launch New Input and named each input with different name, I thought that would be one input (or host if u worked with Zabbix or any other tool ) per client.
So I configured a different port for each host.

So now I consider that we can create a new input , GELF TCP for example, assign a name and port where all clients will connect and send logs, right?
How I can distinguish which client is sending data?
Thank you once again!


(Jochen) #9

Yes, exactly.

You can distinguish different clients by their IP address or any field the protocol supports, for example GELF has a dedicated field for the name of the source.