i have several graylog server nodes and one data nodes.
on all the servers in can see the default index set. and the messages stored on it.
when i create another index set on one of the nodes i cannot see in on the other nodes when i go to the Indices & Index Sets screen. and i cannot see the messages for that index on the other nodes unless i the the stream that receives messages to the new index not to delete duplicates from the all messages stream. what am i doing wrong?
Make sure that all Graylog nodes are using the same MongoDB database.
How exactly did you configure the different nodes in your environment?
i have 4 server nodes(each one has its mongodb database) all configured to retreive data from one data node.
up untill now only one server was working with inputs to recieve the messages using the default
now i decided to add some inputs on another server and create a different index set on that server to recieve and collect the data separately from the default index set.
All Graylog nodes have to use the same MongoDB database.
ok
and then all of then will be able to recognize all the inputs and index sets no matter what server its configured on?
Probably yes.
It’s a basic requirement of a Graylog cluster that each node has access to the same MongoDB database.
ok
the mongodb can be one of the nodes?
You can (and should) have mongodb in several nodes. Then you can shut down any node with mongodb for maintenance, and the other nodes continue to work.
Just make a mongodb replica set, and you are done.
thanks
i am still trying to understand this mongodb and how it works and the replica sets.
This explanation + instruction on how to make it work is good: https://docs.mongodb.com/manual/tutorial/deploy-replica-set/
Just one note: if you cannot use a host firewall to restrict connections, you should use authentication with mongodb. https://docs.mongodb.com/manual/core/authentication/index.html
thanks
until i learn how to configure a replica set can i simply point the other servers to the mongodb on one of them like that?
mongodb_uri = mongodb://172.25.231.32:27017/graylog
Yes, you can. The only problem is that when you have that node down for maintenance, all other nodes are also, as the graylog-server cannot reach the database.
Even with this approach (having just one mongodb instance, you need to think about protecting it with firewalls and/or authentication.
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.