I am using Graylog 3.3 and had winlogbeat installed on two VMs. Even after I have removed the collector configuration for both of them, I still get the log data from these beats. I checked the API too for mapped configurations and none of the VMs have winlogbeat configs mapped. Is there a way to stop them?
Hello,
What kind of devices do you have that are sending logs to Graylog?
It would seam there is something else send logs to Graylog on those device. I would check my network and services on both devices that is send information to graylog.
Thanks for answering. You were right, there was a separate service sending the data. On this note, is it possible that the collector continues to run even after the configuration has been cleared? Because I was able to see the config yaml for multiple collectors whose configs were cleared in the sidecar administration page.
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.