Hi All,
I have installed Graylog 2.3.1 in ubuntu 16.04 which is newly created instance in GCP (Google cloud platform), Elasticsearch & Mongo db were running in the same instance. Graylog application was up and running.
Below are the server.conf file changes in Graylog node1,
is_master = true
node_id_file = /etc/graylog/server/node-id
password_secret = yE3tQ931kKvFrLq2gdDbknUoAVIUqntipX2nMbybgftFZqP7fvmfONZ
root_password_sha2 = 1205814f8b6bc49672c4c74e25b497770b1
plugin_dir = /usr/share/graylog-server/plugin
rest_listen_uri = http://10.128.0.9:9000/api/
rest_transport_uri = http://104.198.57.170:9000/api/
web_listen_uri = http://10.128.0.9:9000/
elasticsearch_hosts = http://graylogssl:9200
rotation_strategy = count
elasticsearch_max_docs_per_index = 20000000
elasticsearch_max_number_of_indices = 20
retention_strategy = delete
elasticsearch_shards = 4
elasticsearch_replicas = 0
elasticsearch_index_prefix = graylog
allow_leading_wildcard_searches = false
allow_highlighting = false
elasticsearch_analyzer = standard
output_batch_size = 500
output_flush_interval = 1
output_fault_count_threshold = 5
output_fault_penalty_seconds = 30
processbuffer_processors = 5
outputbuffer_processors = 3
processor_wait_strategy = blocking
ring_size = 65536
inputbuffer_ring_size = 65536
inputbuffer_processors = 2
inputbuffer_wait_strategy = blocking
message_journal_enabled = true
message_journal_dir = /var/lib/graylog-server/journal
lb_recognition_period_seconds = 3
mongodb_uri = mongodb://localhost/graylog
mongodb_max_connections = 1000
mongodb_threads_allowed_to_block_multiplier = 5
content_packs_dir = /usr/share/graylog-server/contentpacks
content_packs_auto_load = grok-patterns.json
proxied_requests_thread_pool_size = 32
And now I tried to add new node to Graylog by installing the same version in another newly created GCP instance,
Below are the server.conf file changes in Graylog node2,
is_master = false
node_id_file = /etc/graylog/server/node-id
password_secret = zEZgZX47tNhvexnF5sAtUz6HMYhwohMhxic95a8yxSfKNn9s1kvZhZae
root_password_sha2 = 5814f8b6bc49672c4c74e25b422cdeb4e951
plugin_dir = /usr/share/graylog-server/plugin
rest_listen_uri = http://10.128.0.8:9000/api/
rest_transport_uri = http://35.193.52.100:9000/api/
web_listen_uri = http://10.128.0.8:9000/
elasticsearch_hosts = http://influxubuntu:9200
rotation_strategy = count
elasticsearch_max_docs_per_index = 20000000
elasticsearch_max_number_of_indices = 20
retention_strategy = delete
elasticsearch_shards = 4
elasticsearch_replicas = 0
elasticsearch_index_prefix = graylog
allow_leading_wildcard_searches = false
allow_highlighting = false
elasticsearch_analyzer = standard
output_batch_size = 500
output_flush_interval = 1
output_fault_count_threshold = 5
output_fault_penalty_seconds = 30
processbuffer_processors = 5
outputbuffer_processors = 3
processor_wait_strategy = blocking
ring_size = 65536
inputbuffer_ring_size = 65536
inputbuffer_processors = 2
inputbuffer_wait_strategy = blocking
message_journal_enabled = true
message_journal_dir = /var/lib/graylog-server/journal
lb_recognition_period_seconds = 3
mongodb_uri = mongodb://localhost/graylog
mongodb_max_connections = 1000
mongodb_threads_allowed_to_block_multiplier = 5
content_packs_dir = /usr/share/graylog-server/contentpacks
content_packs_auto_load = grok-patterns.json
proxied_requests_thread_pool_size = 32
How to add this new node to my Graylog node1? and it will helps to processing the messages smoothly with any issues
Is there any configuration I missed in the Graylog node2 server.conf file?
Please share your thoughts and correct me If I am wrong in the setup it would be very helpful.
I followed the multi node setup by refering the below link,
http://docs.graylog.org/en/2.4/pages/configuration/multinode_setup.html
Regards,
Ganeshbabu R