Ntopng to graylog

Graylog Central (peer support)
19

Whose performance? The write performance of NTopNG? The query performance of NTopNG? Something else?

These are questions I feel you are better off asking the NTopNG people because it pertains to their application code and not Graylogs… If you’re going to use the NTopNG GUI to query, then all the more so: ask them, not here.

They have some FAQs but they don’t necessarily cover the performance of Elastic vs MySQL as their storage backend.

EDIT:
Heh, there are people using both at the same time, for separate parts of the NTopNG functionality.

EDIT 2:
Right… I’ve gone over your post-history a little bit and apparently you DO want to use Graylog to query the NTopNG data, instead of using the NTopNG GUI. That was not clear to me from just this thread.

So yeah, you are in the right place to ask about Graylog. Your current challenge is that NTopNG can directly output into ElasticSearch, but doing so would bypass the meta-data addition that Graylog usually does (as @macko003 mentioned). That’s not something that is easily solved.

Back in 2015 the NTopNG people made an effort to nicely integrate with ELK though…

So it’s been done, but for different tools.

EDIT 3:
So… NTopNG can send to three different outputs: Elastic, MySQL and LogStash (source).

  • Graylog nor Elastic can work with MySQL
  • Putting data directly into Elastic leaves it without the Graylog metadata.
  • Which leaves LogStash…

There are ways of getting LogStash streams into Graylog (for example). So you could make it work by doing:

NTopNG → LogStash → ??? → Graylog → Elastic

EDIT 4:
Well looky here! The Marketplace has an input for LogStash. And it also notes something important: it has been replaced with the standard BEATS input. Does LogStash speak BEATS by default? Then this could be your saving grace :slight_smile:

NTopNG -> LogStash (BEATS) -> Graylog -> Elastic