"I have datacenters across the world and do not want logs forwarding from everywhere to a central location due to bandwidth, etc. How do I handle this?"
Answer: “You can have multiple graylog-server instances in a federated structure, and forward select messages to a centralized GL server.”
Can someone provide the documentation for a federated structure setup?
This refers to the possibility to create a GELF output in Graylog and send the messages of all streams (or of the “All messages” stream) to another Graylog node, see System / Outputs in the Graylog web interface.
What is a “small” datacenter? How many clients, how many events per second (on average and in peak), and how big are the messages?
Thanks. At what number of clients/events per second would you recommend a full production setup (at least 2 graylog nodes with a load balancer, and at least 3 elasticsearch nodes)?
Please ignore the 2 values I provided earlier. Thanks.