We’re currently running multiple instances of graylog 3.0. We have some graylog components (inputs/extractors, dashboards and streams) that we wanted to easily deploy across those graylog instances and content packs seemed to be the way to go to move those components across our different graylog instances to avoid having to reconfigure the components manually everytime.
Say I have 2 instances running (A and B) and 1 input that I wanted to change (add an extractor), I was expecting to be able to create a new revision of the content pack from the “A” instance, download it, and then upload it to instance “B”. But whenever I upload and install it on instance “B”, my components are duplicated, graylog doesn’t seem to be able to match the components by id’s and update then instead, it create duplicates.
Am I missing something or I’m expected to tear down / delete all my components everytime I want to upload a new version of my content packs?
Hello,
If you just want a new dashboard, Pipeline, search, Notification, input, etc… the content pack can be used. Just highlight what you want on the bottom of “Create content packs”
I was referring to only new configured extractors on a input.
If you made a new GROK patter you can copy those over very easy, if your copying all components over again then yeah it will create duplicates. I have not found a way for Graylog to over write duplicates yet when uploading a similar Content pack and to be honest I don’t think Graylog is able at this time to do that.
