Use ContentPack with existing Input Module

Graylog Central (peer support)
1

Dear all,

is it possible to use a new ContentPack with an existing input module?
I’m trying to use this content pack https://marketplace.graylog.org/addons/b11664ca-1cf5-40bb-a3c1-d230ae9d950d
but it seems to create a new input source…

"inputs" : [ {
"title" : "WinLogs-gelf",
"configuration" : {
  "port" : 5414,
  "override_source" : "",
  "bind_address" : "0.0.0.0",
  "recv_buffer_size" : 1048576
},

But I can’t just delete this block as it seems to be bound to the whole input section along with GROK patterns, etc…

So, do you know if it’s possible to use a content pack without having it create another input source?

cheers,
theresa

2

No, that’s not possible.

If a content pack contains an input and you apply the content pack, the input will be created.

3

Ok, but would it be possible to use fragments of the content pack? e.g the GROK patterns and dashboards, etc…?

4

You can delete parts of the content pack (in the JSON file) before importing it.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.