First question: would this be the best site for general configuration and troubleshooting questions, or is there a dedicated Slack channel for that somewhere?
Second question, I have a use-case were a single macOS host with no connectivity to the internet needs to have its logs aggregated and stored for an entire year. I believe this can be done using Graylog but I am not sure how much engineering effort would go into designing a solution for a single host, and what backend I would need, example, a full Elastic cluster backend, or Mongo DB.
Also, its not clear to me which log shipper i would use on the Mac to support Apple’s UL framework, if that would be Filebeat and if so, would I use Logstash to get into Graylog?
Unfortunately I do not have apply device, but someone here might. I would assume that when you configure FileBeat paths: - /path/to/some/logs/*.log it should work. Just make sure Filebeat can access those logs (i.e. permissions).
Yes, your single node would have Graylog, Elasticsearch and MongoDb. In the documentation would have all you answers for this.
My first time after reading the documentation ( Copy & Pasting) about an hour.
It is highly recommended to go over what installation your using and how to install it. This will prevent those " Gotcha’s" later on.
Well… I did some research on Unified Logging and Activity Tracing with Apple. All I can say is wow.
There are tools out there that can read .tracev3 format and maybe they can create a text file for FileBeat to send those logs to Graylog. This was something I came across