Graylog Sidecar is a wrapper for (i.e. Nxlog, Winlogbeat, FileBeat, etc…). In layman’s terms it controls these services from a remote destination. With that been said, Graylog Sidecar is the middle man between the Web UI and the log shipper. I haven’t seen Graylog sidecar command/s to execute these services. If you want to use line commands this would defeat the purpose of convenience through the Web UI. As a suggestion I would just use FileBeat Service instead if that’s the route you want to go.
What I do know is once you install GL Sidecar and enable the preferred log shipper on the Web UI you can execute the systemd command to show the status of that log shipper.
Sum it up I’ll show my lab configuration /setup.
Example of Graylog sidecar on Linux server using FileBeat.
As shown below once you click the tic box then navigate to the upper right under “Process” you would be able to “Stop, Start, Restart” the Beat service.
Now, Ill show the Filebeat service from this node.
root # systemctl status filebeat
So I guess the answer to this post is once you install GL to can use SystemD to “Stop. Start, Restart” the service.
This is not preferred since the Graylog Sidecar was made for convenience, It does resemble Ansible in a way.
Graylog Sidecar is a lightweight configuration management system for different log collectors, also called Backends. The Graylog node(s) act as a centralized hub containing the configurations of log collectors.
Graylog sidecar does control log shippers but its used for the connection between Graylog’s Web UI and the remote node. Graylog sends the commands to GL sidecar and the sidecar executes them, I’m not aware of line commands to execute for Graylog sidecar.
Let’s say you want to use FileBeat /w Graylog sidecar and adjust FileBeat configuration file on this node without using the Web UI ( Not preferred).
Graylog sidecar with FileBeat the log shipper configuration file location shown below. This depends on the what OS is used.
FileBeat ( single installation) without Graylog Sidecar Installation, the configuration file is located below.
Hope that helps