Hey @isotecviac2022
For ES/OS there is a setting called discovery.type: single-node
From that setting replication between ES/OS nodes should should not happen.
Now, as for sending data from INPUT to a specific ES/OS node I’m not 100% sure but i have never done that or seeing it done.
BUT, a stream has a setting called "Outputs’ so basically you can forward data to another Graylog server, But its not forwarding to a single ES/OS instance.
Another Idea would be using Logstash on Graylog server an redirecting it to ES/OS instance, now I have done that.
Example:
logstash_example
# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.
input {
beats {
port => 5044
tags => [ 'beat' ]
}
}
input {
udp {
port => 5144
tags => ['syslog']
}
}
input {
http {
port => 12345
tags => ['fluent']
add_field => { "[@metadata][input-http]" => "" }
}
}
filter {
if [@metadata][input-http] {
date {
match => [ "date", "UNIX" ]
remove_field => [ "date" ]
}
mutate {
remove_field => ["headers","host"]
}
}
}
filter {
if "syslog" in [tags] {
grok {
match => ["message", "%{SYSLOG5424PRI}%{GREEDYDATA:message}"]
overwrite => [ "message" ]
}
kv {
source => "message"
value_split => "="
}
}
}
filter {
if "syslog" in [tags] {
mutate {
remove_field => [ "addr","appcat","craction","crlevel","crscore","devtype","dstdevtype","dstosname","dstserver","dstserver","fazlograte","freediskstorage","interface","log.syslog.priority","masterdstmac","mastersrcmac","osname","policytype","poluuid","setuprate","srchwvendor","srcserver","total","totalsession","used","user","vd"]
}
}
}
output {
if "beat" in [tags] {
opensearch {
hosts => ["https://graylog-server_1:9000"]
auth_type => {
type => 'basic'
user => 'admin'
password => 'changeit'
}
ecs_compatibility => disabled
ssl => true
ssl_certificate_verification => false
cacert => "/opt/logstash-8.6.1/root-ca.pem"
}
}
if "syslog" in [tags] {
opensearch {
hosts => ["https://elasticsearch_node_1:9200"]
auth_type => {
type => 'basic'
user => 'admin'
password => 'changeit'
}
ecs_compatibility => disabled
ssl => true
ssl_certificate_verification => false
cacert => "/opt/logstash-8.6.1/root-ca.pem"
index => "firewall-%{+YYYY.MM.dd}"
}
}
if "fluent" in [tags] {
opensearch {
hosts => ["https://elasticsearch_node2:9200"]
auth_type => {
type => 'basic'
user => 'admin'
password => 'changeit'
}
ecs_compatibility => disabled
ssl => true
ssl_certificate_verification => false
cacert => "/opt/logstash-8.6.1/root-ca.pem"
index => "fluent-bit-%{+YYYY.MM.dd}"
}
}
}
Note I use aother OpenSource software attached to the single ES/OS instance to analyze my data and using Graylog as conduit.
