@Jochen, I’ve never found a use case for the Graylog Collector. It must be the generic wiki article that doesn’t do a good job at explaining why you would even care to use it.
It makes sense to use a system like Kafka to handle message digestion at the perimeter in a huge enterprise, but GC instead sits inside the server and acts as the middle-man between inputs, providing what benefits exactly? It also seems very counter-intuitive to provide a GUI configurable interface from within Graylog itself, since most settings are stored in the server.conf file. It would make more sense to build out an additional collectors.conf file that has all of your node information and doesn’t rely on two separate coding languages just to reanimate a deprecated application. Why not redirect this time and energy towards building out and expanding the dashboards? I have a list of over a dozen items in the dashboard alone that are still in need of some very deserved TLC to help keep Graylog relevant.
But, TLDR, why would you need that if you are only ingesting Apache Logs? All you need is to utilize a GELF_TCP input and a program like nxlog to get it there. Extractors are your friend, but the GC won’t help you there. It honestly seems like wayy too much work just for cosmetics.