please forgive me that I constantly create new topics as I find my way into the Graylog world.
At the moment my setup consists of a Graylog server (incl. MongoDB) and an Elasticsearch server.
I have configured my Graylog server to also be a Elasticsearch Master node, while the Elasticsearch server is only a data node.
The config of the master node is located in /etc/graylog/server/server.conf and I configured the index of my elasticsearch data node through the WebUI for max. number of indices and rotation period.
My question now: is this stored somewhere in a config file? Because I can’t seem to find this setting through the elasticsearch.yml file on my elasticsearch (data) server.
and the setting of my master node in the server.conf still says:
rotation_strategy = count
elasticsearch_max_docs_per_index = 20000000
elasticsearch_max_number_of_indices = 20
this doesn’t match with what I have configured through the webUI, so it is probably stored somewhere else…but where?
you are welcome and this community is for the exchange of information and to learn - and that include asking questions.
First your setup is not recommend - the elasticsearch node that is part of Graylog should be a no-data and a no-master node. Additional in the next version (2.3) this part will fall off. So no more Elasticsearch Node inside of Graylog.
Now to your Question - the configuration is saved in the MongoDB, like any configuration that is done via the GUI of Graylog.
thanks for getting back to me
Is there any way to read the configuration from the MongoDB? I might be a little paranoid, but I just want to verify that everything is stored correctly there as I see it in the GUI of Graylog.
Ok, this means that I would need another virtual machine for the master-no, to migrate this from the Graylog server. Is there any recommendation in terms of resources for just a simple elasticsearch master node? What is the downside of running a Graylog server as an elasticsearch master node?
does it make any sense to change the graylog server.conf (for the existing master node) or the elasticsearch configuration through the yml file when everything is stored in the MongoDB (via the WebUI) anyway?
