We are looking to do regular scheduled backup on our graylog server to backup the configs. Right now it’s backing up the /usr/share/graylog/ and /etc/graylog/server/ directories. Where is the configuration for extractors saved and is there a way to export this from the web UI?
Extractors can be exported on the Web-UI at the System >> Content Packs menu. They are included in their respective inputs. Download a content pack of your inputs and search for the json array “extractors” in each input definition.
I guess the extractors are stored inside MongoDB. (Correct me if I’m wrong.) Since MongoDB holds most of Graylog’s configuration I would highly recommend you to make regular backups of it as well.
Greetings - Phil
ahh ok, i had to goto inputs>respective input>manage extractors>actions>export extractors. Probably should have looked before I posted. Thanks for the reminder about backing up mongodb.
Oh right, I completely forgot about that
Thanks for the heads up
All dynamic (i. e. runtime) configuration of Graylog is stored in MongoDB, so if you want to have a complete backup, you’ll have to back-up the Graylog database in MongoDB: https://docs.mongodb.com/manual/core/backups/