Updating components from content packs


We’re currently running multiple instances of graylog 3.0. We have some graylog components (inputs/extractors, dashboards and streams) that we wanted to easily deploy across those graylog instances and content packs seemed to be the way to go to move those components across our different graylog instances to avoid having to reconfigure the components manually everytime.

Say I have 2 instances running (A and B) and 1 input that I wanted to change (add an extractor), I was expecting to be able to create a new revision of the content pack from the “A” instance, download it, and then upload it to instance “B”. But whenever I upload and install it on instance “B”, my components are duplicated, graylog doesn’t seem to be able to match the components by id’s and update then instead, it create duplicates.

Am I missing something or I’m expected to tear down / delete all my components everytime I want to upload a new version of my content packs?

Thanks !

Hello && Welcome

If you just want extractor/s on a INPUT moved to other Graylog instances I would just use the Export/Import on the Input.

On Node A I created more extractor’s and want to upload them on Node B Input.

I would navigate to the Input On Node A and Click on Manage extractors.

Upper Right Corner , Click on “Action”.

The copy that to Node B. You would Click on Import.

Just Click on “Paste”. If all set, Click on “Add extractors to input” Should be good.

Hope that helps

Weve been using that feature before switching to content pack thinking we could export all our components at the same time but I guess its a no go.

Thanks !

If you just want a new dashboard, Pipeline, search, Notification, input, etc… the content pack can be used. Just highlight what you want on the bottom of “Create content packs

I was referring to only new configured extractors on a input.
If you made a new GROK patter you can copy those over very easy, if your copying all components over again then yeah it will create duplicates. I have not found a way for Graylog to over write duplicates yet when uploading a similar Content pack and to be honest I don’t think Graylog is able at this time to do that.