How to explore existing Elasticsearch index data?

Graylog Central (peer support)
1

Hi,

I am currently using AWS Elasticsearch service. AWS CloudWatch sends the log data to AWS Elasticsearch.
I have daily indexes created as below through a Lambda function which sends the CloudWatch logs to AWS Elasticsearch.

cwl-2019.01.23
cwl-2019.01.22
cwl-2019.01.21

I could not explore these index data through GrayLog. I don’t want to create an input on GrayLog. I just want to explore already existing elastic data on GrayLog. Is it possible or not?

Thanks

2

what you request is not possible with Graylog.

1 Like
3

Thanks for the response. Why impossible? How can I use Graylog with AWS Elasticsearch & AWS CloudWatch Logs?
As I understand, I must ingest logs to Graylog somehow and Graylog writes to elastic; but I could not find a way for AWS CloudWatch logs.

4
  1. GL read only the index set’s what you define (you know there is a settings about the name of the indices…)
  2. GL stores a lot of hidden information about the message in elasticsearch (search, show all fields)
1 Like
5

Why impossible? How can I use Graylog with AWS Elasticsearch & AWS CloudWatch Logs?

I do not say it is impossible - but I wrote that what you request is not possible.

As @macko003 wrote Graylog needs to process the message as some additional (meta) information are stored together with the message. Such what user is allowed to see the information etc. That is why you would need to ingest the AWS Logs to Graylog, let Graylog process the messages and then store in AWS Elasticsearch.

Graylog is not like Kibana, that is the reason what you request is not possible.

2 Likes
6

Hi,
I am rather new to graylog and log-monitoring but I am glad I found this post the other day, I was trying to figure out the same issue, for almost 3 months now.

In addition to the last posts, would it be possible to create a pipeline for logs from filebeat, into logstash, into graylog, then into Elasticsearch?

If it is not allowed to ask “new” questions in one post, then just tell me and I will start a new discussion.

Thanks

7

it is prefered to move nw questions over to new topics.

but you can ingest filebeat direct into Graylog - no need of a logstash in between. Check the getting started guide: http://docs.graylog.org/en/2.5/pages/getting_started/planning.html

1 Like
8

Ayght, will keep it in mind on future posts.

Thanks for the reply

9

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.