I used graylog v2 initially with an ova appliance …
then when v3 came out i didn’t really care about the old data - i still had it and started fresh with a new clean install via apt-get as i wanted to customize the install a little bit
so now i have split data … how can I easlily migrate the old data (about 5GB) to the now running live/prod system?
i though first about export / import … but it doesn’t seem to exist like that in the graylog gui nor with elasticsearch - but a snapshot / restore feature … (also copying elasticsearch datafiles around doesn’t seem to be suggested - possible difference in elasticsearch versions)
merging the elasticsearch instances to a cluster, which I saw as a suggested solution, seems a bit excessive … and i’m also concerned about the possible data(base) structure changes between v2 and v3 that this might create problems … i am also concerned restoring a snapshot as suggested after i already have new data running on the live / prod system that this would overwrite the db - or is this operation additive and there is no schema change that would create problems?
what i now think is the best/easiest solution is to send (replay) the old stored logs out from the old system (ex gelf formatted) to the new system.
is there already something in place to do this … possibly even from the gui or would i have to create a script to replay, send out stored log messages? …
how to easily hook into graylog via scripting - would i have to write some java to do something like this? aka write a plugin - or exists some ex. python scripting layer on the graylog-server / api?
thank you for any hints & suggestions
what I read / saw are the following posts that have some relation to this - the suggestion of restoring from snapshots and creating a cluster to move data