# Inputs Set to Start By Default

**URL:** <https://community.graylog.org/t/inputs-set-to-start-by-default/21310>\
**Category:** Graylog Central (peer support)\
**Created:** [September 27, 2021, 5:53pm UTC](https://community.graylog.org/t/inputs-set-to-start-by-default/21310 "2021-09-27T17:53:12Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![danmassa7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/danmassa7/32/9723_2.png) [@danmassa7](https://community.graylog.org/u/danmassa7)\
**Post date:** [September 27, 2021, 5:53pm UTC](https://community.graylog.org/t/inputs-set-to-start-by-default/21310/1 "2021-09-27T17:53:12Z")

</div>

## Probem Description

It seems whenever I restart Graylog all the inputs start by default.  
I have a couple of Inputs that I only start as needed because they consume a lot of database/CPU resources. Can I configure an input that does _not_ start by default unless the system administrator explicitly starts it?

Thank you for your help.

## Environmental information

### Operating system information

centos-linux-release-8.3-1.2011.el8.noarch

### Package versions

- Graylog 4.0.7
- MongoDB 4.2.14
- Elasticsearch 7.10.2

---

<div class="post-metadata">

**Author:** ![aaronsachs](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/aaronsachs/32/7180_2.png) [@aaronsachs](https://community.graylog.org/u/aaronsachs)\
**Post date:** [September 27, 2021, 9:46pm UTC](https://community.graylog.org/t/inputs-set-to-start-by-default/21310/2 "2021-09-27T21:46:07Z")

</div>

Hi there, there’s an open issue for this here: [Disable inputs auto starting · Issue #10955 · Graylog2/graylog2-server · GitHub](https://github.com/Graylog2/graylog2-server/issues/10955). I’d recommend adding a comment to let our product team know that you’d like to have this capability added to Graylog.

---

<div class="post-metadata">

**Author:** ![danmassa7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/danmassa7/32/9723_2.png) [@danmassa7](https://community.graylog.org/u/danmassa7)\
**Post date:** [September 27, 2021, 11:14pm UTC](https://community.graylog.org/t/inputs-set-to-start-by-default/21310/3 "2021-09-27T23:14:54Z")

</div>

Dear Product Team,  
Yes please. This is a feature that would be appreciated.  
–Dan

---

<div class="post-metadata">

**Author:** ![danmassa7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/danmassa7/32/9723_2.png) [@danmassa7](https://community.graylog.org/u/danmassa7)\
**Post date:** [September 27, 2021, 11:26pm UTC](https://community.graylog.org/t/inputs-set-to-start-by-default/21310/4 "2021-09-27T23:26:55Z")

</div>

In the meantime, I tried the following:

1. I setup a Stream to handle this particular input called ASA\_AnyConnect
2. I setup a Pipeline called “Bit\_Butcket” and connected it to the ASA\_AnyConnect Stream.
3. That pipeline has one stage with one rule:

```auto
rule "Drop_Message"
when
   true
then
   drop_message();
end

```

This plan seems good except for two issues:

1. It doesn’t work. The stream shows thousands of msg/s but the pipeline shows zero msg/s. Probably user error as this is my first pipeline I’ve setup.
2. If it did work, it remains to be seen how much this would help me. Without this rule, turning on this input pegs all four of my CPUs and makes the whole system unresponsive. With this rule, would it be any better? It would certainly save on my disk space, but I’m primarily interested in the system staying responsive and performant.

Can someone suggest what I should do to trouble shoot this? What can I post to this message board to help with the troubleshooting?

Thanks.

---

<div class="post-metadata">

**Author:** ![aaronsachs](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/aaronsachs/32/7180_2.png) [@aaronsachs](https://community.graylog.org/u/aaronsachs)\
**Post date:** [September 27, 2021, 11:27pm UTC](https://community.graylog.org/t/inputs-set-to-start-by-default/21310/5 "2021-09-27T23:27:23Z")

</div>

Hi Dan,

I meant on the GitHub issue. Our product team isn’t generally active in the forums. They’re more likely to see your comment on the GitHub issue.

---

<div class="post-metadata">

**Author:** ![danmassa7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/danmassa7/32/9723_2.png) [@danmassa7](https://community.graylog.org/u/danmassa7)\
**Post date:** [September 28, 2021, 11:55am UTC](https://community.graylog.org/t/inputs-set-to-start-by-default/21310/6 "2021-09-28T11:55:04Z")

</div>

Can you provide a URL to “Github Issue”? I don’t know what this is.  
Thanks.

---

<div class="post-metadata">

**Author:** ![aaronsachs](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/aaronsachs/32/7180_2.png) [@aaronsachs](https://community.graylog.org/u/aaronsachs)\
**Post date:** [September 28, 2021, 12:43pm UTC](https://community.graylog.org/t/inputs-set-to-start-by-default/21310/7 "2021-09-28T12:43:32Z")

</div>

The link is in my reply here [Inputs Set to Start By Default - #2 by aaronsachs](https://community.graylog.org/t/inputs-set-to-start-by-default/21310/2)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [October 12, 2021, 12:44pm UTC](https://community.graylog.org/t/inputs-set-to-start-by-default/21310/8 "2021-10-12T12:44:08Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.