Should there be an input dedicated to internal Graylog events? These two indexes exist but they’re completely empty. The logging page indicates graylog has written over a million internal messages. Where are they going?
he @richardm1
the Graylog events and System Events are the indices where Graylog is storing the “alerts” or other system logs.
But not everything. Your ingested messages are by default written to the default index set.
How do Graylog events and messages make their way into these indexes? Should there be an input dedicated to Graylog itself? Or is all of this routed internally? I’m trying to figure out why these indexes are empty.
this indices will get filled by Graylog when you define event definitions in the “alert” section of Graylog.
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.