More than one Collector Configuration

[neophilipp]

Hello,
i use newest Graylog version (3.0.2) and newest Sidecar (1.0.1) and Filebeat Version.

How is it possible to add more than one configuration, for example one for all “standard” linux logfiles and one more for haproxy, to one sidecar?
In older versions i could give the sidecar-collector many “tags” and for each “tag” one config.
Now i only can give one config per collector.

Where can i give more configs to one sidecar?

[michael.ehrenreich]

Moin,

I think that’s not possible. Each single configuration is stored in a generated filebeat config and only one instance of filebeat is started then:

/usr/share/filebeat/bin/filebeat -c /var/lib/graylog-sidecar/generated/filebeat.conf

[neophilipp]

Ok, thank you for help!

If i understand it right i can do it if i create more instances of filebeat. Right?
Do you think it is a good idea how i did it?

[michael.ehrenreich]

I think that’s a feasible solution.

I’m not sure if it works correctly for all instances using the same ID.

# The node ID of the sidecar. This can be a path to a file or an ID string.

# If set to a file and the file doesn't exist, the sidecar will generate an

# unique ID and writes it to the configured path.

#

# Example file path: "file:/etc/graylog/sidecar/node-id"

# Example ID string: "6033137e-d56b-47fc-9762-cd699c11a5a9"

#

# ATTENTION: Every sidecar instance needs a unique ID!

#

#node_id: "file:/etc/graylog/sidecar/node-id"

I’d give it a try.

[jan (Jan Doberstein)]

you could generate “meta” configurations that include other configurations.

Use the template model for that - this way you have configurations in the templates and use that inside the configurations for specific hosts.
if you change a template all hosts with that template will get the update.

just as idea.