Use ContentPack with existing Input Module

Dear all,

is it possible to use a new ContentPack with an existing input module?
I’m trying to use this content pack https://marketplace.graylog.org/addons/b11664ca-1cf5-40bb-a3c1-d230ae9d950d
but it seems to create a new input source…

"inputs" : [ {
"title" : "WinLogs-gelf",
"configuration" : {
  "port" : 5414,
  "override_source" : "",
  "bind_address" : "0.0.0.0",
  "recv_buffer_size" : 1048576
},

But I can’t just delete this block as it seems to be bound to the whole input section along with GROK patterns, etc…

So, do you know if it’s possible to use a content pack without having it create another input source?

cheers,
theresa

No, that’s not possible.

If a content pack contains an input and you apply the content pack, the input will be created.

Ok, but would it be possible to use fragments of the content pack? e.g the GROK patterns and dashboards, etc…?

You can delete parts of the content pack (in the JSON file) before importing it.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.