we are about to deploy Greylog Open Source on a production environment for a system that it is expected to produce 0,1 Gb per day of logs, and going live very soon. We are planning to use for that the AMI image - the one under http://docs.graylog.org/en/2.4/pages/installation/aws.html , to save deploying time. I know that this system is not supposed to be created to provide a production ready solution - however, what are the risks if we do that anyway ? I need to justify the additional effort of going the full length of a complete installation.
What I would think of is a XS deployment, on AWS, based on Ubuntu, on a t2.large machine, containing everything : Greylog, Elasticsearch, Mongodb.
You won’t be able to get support and you won’t be able to customize every aspect of the system (see http://docs.graylog.org/en/2.4/pages/configuration/graylog_ctl.html).
Hi Jochen, thank you for your answer. I understand that the link that you attached is the list of aspects of the system that I would be able to configure in the AMI, because Graylog_ctl is a tool shipped with the Virtual Machine Appliances, but limits your options and overwrites the real configuration file.
On the other hand, on an Ubuntu image on AWS, you are supposed to edit server.conf directly, so I understood, and other configuration files, having total control.
The problem I met on the image was also than the directory structure was not the same as described in the documentation, and also that in case of trouble I might not be able to find appropriate documentation and answers.
Is my understanding correct ?
If you found an error in http://docs.graylog.org/en/2.4/pages/configuration/file_location.html, please create a bug report (or a pull request fixing the issue) at Issues · Graylog2/documentation · GitHub.
Sorry, my mistake, I was referring to the wrong chapter. The directories and files under the chapter “Omnibus package” correctly list the graylog directories in the AMI.
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.