We are provisioning a new Graylog 2 cluster with fresh MongoDB and Elasticsearch instances. Since our cluster stores only 7 days of data, the idea is to duplicate the logs to both the clusters and eventually discard the old Graylog 1.x cluster.
How do I migrate the streams and alerts to the new cluster. Would dumping relevant collections and moving them to the new Mongo instance work? If so, what collections should I move?
You’ll have to move the streams, streamrules, alerts, and alarmcallbackhistory collections to the new MongoDB database. If you also want to use the old dashboards, you’ll additionally have to move the dashboards collection.