Graylog Multi-Node Topologies

Graylog Central (peer support)
1

Hi,

as I didn’t found any info on possible topologies of a multi-node setup i ask it here.

Is it possible to do a multi-node setup with a star topology? So that only the master node sees all other nodes. And the nodes work on there own, and process the logs alone?

Or do I have to have a meshed topology for all nodes?

The Nodes should only work as aggregator + some pipeline magic for multiple beats to output to an ES-Cloud instance. So no searching on this “Edge”-nodes.

thx

2

currently what you have in mind is not possible - you can see that as issues in the Graylog server repo with the keyword federation

With the current Graylog Forwarding in Enterprise you could forward from one to another Graylog and do the parsing at the initial sender to provide only already parsed messages or only specific details over to a central Graylog. But that might not be what you are looking for.