Log shipping to 2 graylog servers

Graylog Central (peer support)
1

I have 2 graylog servers. How do I send information from a server to the 2 graylogs?
I wanted to know about the configuration of linux sidecars and GELF Windows.

2

What type of log shipper do you use (filebeat, mxlog)? For example filebeat can’t send to more than one output, but still you can create 2 filebeat configuration and assing to sidecar.

3

I’m using filebeat. How do I create 2 filebeat configurations and associate to sidecar

4
  1. Clone previous collector Log Collector in System - Sidecars - Configuration - select filebeat collector - click More Actions - Clone name it and change output address for second graylog and data and log dirs:
output.logstash:
   hosts: ["SECOND_GRAYLOG_IP:PORT"]
path:
  data: C:\Program Files\Graylog\sidecar\cache\filebeat2\data
  logs: C:\Program Files\Graylog\sidecar\logs2
  1. Create second Configuration in System - Sidecars - Configuration - Create Configuration
  2. Assign new configuration in System - Sidecars - Administration, check (tick) newly created log collector, and then click Configure - and select newly created configuration.
  3. Done

https://docs.graylog.org/en/3.3/pages/sidecar.html#step-by-step-guide

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.