# \#sidecar **URL:** https://community.graylog.org/tag/sidecar/16.md [Latest](https://community.graylog.org/latest.md) · [Categories](https://community.graylog.org/categories.md) · [Tags](https://community.graylog.org/tags.md) --- ## [Graylog sidecar rpm repo problem](https://community.graylog.org/t/graylog-sidecar-rpm-repo-problem/37337)
**Author:** [@wscherer.uillinois](https://community.graylog.org/u/wscherer.uillinois)\ **Replies:** 2\ **Last updated:** [June 1, 2026, 1:13pm UTC](https://community.graylog.org/t/graylog-sidecar-rpm-repo-problem/37337 "2026-06-01T13:13:18Z")
I’ve noticed that since last week (May 21) when trying to update the graylog-sidecar package on RHEL-8/9 I get these errors $ yum list available graylog-sidecar \ graylog … --- ## [Sidecar configurations randomly unassigned](https://community.graylog.org/t/sidecar-configurations-randomly-unassigned/37213)
**Author:** [@rodney\_vdw](https://community.graylog.org/u/rodney_vdw)\ **Replies:** 4\ **Last updated:** [May 6, 2026, 9:56am UTC](https://community.graylog.org/t/sidecar-configurations-randomly-unassigned/37213 "2026-05-06T09:56:41Z")
similar to Graylog 7.0.4 - All Sidecar loses Configuration after server reboot Graylog sidecar configurations are been randomly unassigned.. There is nothing of value in the graylog server logs.. The screenshot is from … --- ## [Graylog-sidecar repo not trusted on Debian Trixie](https://community.graylog.org/t/graylog-sidecar-repo-not-trusted-on-debian-trixie/37100)
**Author:** [@reduzent](https://community.graylog.org/u/reduzent)\ **Replies:** 0\ **Last updated:** [March 18, 2026, 8:57am UTC](https://community.graylog.org/t/graylog-sidecar-repo-not-trusted-on-debian-trixie/37100 "2026-03-18T08:57:27Z")
Dear Community This is my first post and I hope this is the right place to post this. I followed the instructions to install the Debian Repo for installing graylog-sidecar from here: When doing apt update after inst… --- ## [Graylog 7.0.4 - All Sidecar loses Configuration after server reboot](https://community.graylog.org/t/graylog-7-0-4-all-sidecar-loses-configuration-after-server-reboot/37044)
**Author:** [@LikeAMader](https://community.graylog.org/u/LikeAMader)\ **Replies:** 3\ **Last updated:** [March 4, 2026, 8:28am UTC](https://community.graylog.org/t/graylog-7-0-4-all-sidecar-loses-configuration-after-server-reboot/37044 "2026-03-04T08:28:20Z")
1. Describe your incident: Hello, I am using a new 7.0.4 environment. I have noticed that all sidecar endpoints lose their respective Winlogbeat and Filebeat configurations after restarting the Graylog server. As a resu… --- ## [Sidecar time period](https://community.graylog.org/t/sidecar-time-period/36793)
**Author:** [@w88888](https://community.graylog.org/u/w88888)\ **Replies:** 3\ **Last updated:** [December 30, 2025, 5:37pm UTC](https://community.graylog.org/t/sidecar-time-period/36793 "2025-12-30T17:37:01Z")
Hi, we are currently testing Graylog. After the first import, we reset the Graylog server. The logs are then imported from where the import left off. Where is the timestamp stored so that we can reset it and get the im… --- ## [Unable to get Server 2019 Event Viewer logs into Graylog via Sidecar and winlogbeat](https://community.graylog.org/t/unable-to-get-server-2019-event-viewer-logs-into-graylog-via-sidecar-and-winlogbeat/36766)
**Author:** [@josephk](https://community.graylog.org/u/josephk)\ **Replies:** 11\ **Last updated:** [December 22, 2025, 4:46pm UTC](https://community.graylog.org/t/unable-to-get-server-2019-event-viewer-logs-into-graylog-via-sidecar-and-winlogbeat/36766 "2025-12-22T16:46:16Z")
Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question. Don’t forget to select tags to help index your topic! 1. Describ… --- ## [Sidecar tls configuration, where are the certificates expected?](https://community.graylog.org/t/sidecar-tls-configuration-where-are-the-certificates-expected/36679)
**Author:** [@schurd](https://community.graylog.org/u/schurd)\ **Replies:** 0\ **Last updated:** [December 2, 2025, 12:30pm UTC](https://community.graylog.org/t/sidecar-tls-configuration-where-are-the-certificates-expected/36679 "2025-12-02T12:30:28Z")
Hello, in the sidecar.yml we have defined: tls\_skip\_verify: true But the connection is encrypted, so where do I have to put the CA Certs on Linux (and on Windows), so the sidecar finds them and we can change to false?… --- ## [Sidecar Update creates new Nod Id](https://community.graylog.org/t/sidecar-update-creates-new-nod-id/36671)
**Author:** [@schurd](https://community.graylog.org/u/schurd)\ **Replies:** 2\ **Last updated:** [December 1, 2025, 11:50am UTC](https://community.graylog.org/t/sidecar-update-creates-new-nod-id/36671 "2025-12-01T11:50:26Z")
Hello, an automated (with Puppet) update of Graylog sidecar from 1.3.0 to 1.5.0 created for every node a new node id. That’s not what we wanted, but anyway we could fix by reassigning the new nodes to the correct si… --- ## [Don't forget to put "default\_ttl" in your scripts, if you don't want your sidecars to gradually expire](https://community.graylog.org/t/dont-forget-to-put-default-ttl-in-your-scripts-if-you-dont-want-your-sidecars-to-gradually-expire/36570)
**Author:** [@InternetWorkAcct](https://community.graylog.org/u/InternetWorkAcct)\ **Replies:** 0\ **Last updated:** [November 7, 2025, 11:04am UTC](https://community.graylog.org/t/dont-forget-to-put-default-ttl-in-your-scripts-if-you-dont-want-your-sidecars-to-gradually-expire/36570 "2025-11-07T11:04:55Z")
If you use Graylog sidecars and register the sidecar runners using scripts, you have to create the tokens with a TTL that doesn’t expire while your nodes are still sending logs. Add {”default\_ttl”: null} to the request … --- ## [Auditbeat still sending data while the server is turned off](https://community.graylog.org/t/auditbeat-still-sending-data-while-the-server-is-turned-off/36438)
**Author:** [@kelematth](https://community.graylog.org/u/kelematth)\ **Replies:** 4\ **Last updated:** [October 16, 2025, 7:12am UTC](https://community.graylog.org/t/auditbeat-still-sending-data-while-the-server-is-turned-off/36438 "2025-10-16T07:12:38Z")
Hi Guys, Previously I have installed several instances of Graylog Sidecar 1.5.1 on Linux systems (Ubuntu Server 24.04) where everything was fine - both the auditbeat and filebeat was running and sending messages to Gray… --- ## [Graylog inactive sidecars stuck](https://community.graylog.org/t/graylog-inactive-sidecars-stuck/36317)
**Author:** [@kelematth](https://community.graylog.org/u/kelematth)\ **Replies:** 3\ **Last updated:** [September 15, 2025, 1:04pm UTC](https://community.graylog.org/t/graylog-inactive-sidecars-stuck/36317 "2025-09-15T13:04:48Z")
Hi guys! At our company we deployed graylog as a solution for collecting logs from our infrastucture. We are at our deployment, in the last step we started deploying the sidecars in our endpoints. For testing the automa… --- ## [Cant assign sidecar configuration in UI](https://community.graylog.org/t/cant-assign-sidecar-configuration-in-ui/35942)
**Author:** [@rodney\_vdw](https://community.graylog.org/u/rodney_vdw)\ **Replies:** 1\ **Last updated:** [July 16, 2025, 3:32pm UTC](https://community.graylog.org/t/cant-assign-sidecar-configuration-in-ui/35942 "2025-07-16T15:32:09Z")
Running latest graylog 6.3.0 and decided to try out sidecars for filebeat configurations. Adding the sidecar is no problem, however I created an additional configuration for filebeat logs but am unable to assign the con… --- ## [Beats not running](https://community.graylog.org/t/beats-not-running/35526)
**Author:** [@arafat16](https://community.graylog.org/u/arafat16)\ **Replies:** 8\ **Last updated:** [May 22, 2025, 6:49pm UTC](https://community.graylog.org/t/beats-not-running/35526 "2025-05-22T18:49:51Z")
Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question. Don’t forget to select tags to help index your topic! 1. Describ… --- ## [Graylog sidecar not forwarding messages but noticing changes](https://community.graylog.org/t/graylog-sidecar-not-forwarding-messages-but-noticing-changes/35073)
**Author:** [@sashah](https://community.graylog.org/u/sashah)\ **Replies:** 0\ **Last updated:** [February 28, 2025, 5:56pm UTC](https://community.graylog.org/t/graylog-sidecar-not-forwarding-messages-but-noticing-changes/35073 "2025-02-28T17:56:10Z")
1. Describe your incident: I am setting up a sidecar to get logs from a windows machine to graylog using filebeat. This is the first time I have done this, but other people at my workplace have set up similar sidecars s… --- ## [Issues with inactive sidecar](https://community.graylog.org/t/issues-with-inactive-sidecar/34088)
**Author:** [@mromeo](https://community.graylog.org/u/mromeo)\ **Replies:** 4\ **Last updated:** [November 11, 2024, 8:55am UTC](https://community.graylog.org/t/issues-with-inactive-sidecar/34088 "2024-11-11T08:55:59Z")
Hi I am having a little issue trying to getting the sidecar working, and keeps saying that it is failing to connect and keeps failing. When checking the status I get this error: level=error msg=“Error fetching server ve… --- ## [Missing log titles in Graylog from Debian VM with Graylog Sidecar](https://community.graylog.org/t/missing-log-titles-in-graylog-from-debian-vm-with-graylog-sidecar/33997)
**Author:** [@tuanson84uk](https://community.graylog.org/u/tuanson84uk)\ **Replies:** 11\ **Last updated:** [November 4, 2024, 7:20am UTC](https://community.graylog.org/t/missing-log-titles-in-graylog-from-debian-vm-with-graylog-sidecar/33997 "2024-11-04T07:20:25Z")
Hi everyone, I’m currently setting up Graylog on a Debian VM, where I’ve installed the Graylog Sidecar along with Auditbeat and Filebeat to collect and forward system logs to the Graylog server. The setup appears to be … --- ## [Do I need to manually enable Windows Audit Logs in secpol.msc after installing Graylog Sidecar?](https://community.graylog.org/t/do-i-need-to-manually-enable-windows-audit-logs-in-secpol-msc-after-installing-graylog-sidecar/33988)
**Author:** [@tuanson84uk](https://community.graylog.org/u/tuanson84uk)\ **Replies:** 4\ **Last updated:** [October 29, 2024, 10:17am UTC](https://community.graylog.org/t/do-i-need-to-manually-enable-windows-audit-logs-in-secpol-msc-after-installing-graylog-sidecar/33988 "2024-10-29T10:17:39Z")
Hey everyone, I recently installed Graylog Sidecar on my Windows machine to collect audit logs, but I’m not sure if I need to manually enable the Windows Audit Logs in secpol.msc, or if Sidecar will automatically enable… --- ## [Graylog Sidecar doesn´t send logs](https://community.graylog.org/t/graylog-sidecar-doesn-t-send-logs/33887)
**Author:** [@benhartwich](https://community.graylog.org/u/benhartwich)\ **Replies:** 3\ **Last updated:** [October 28, 2024, 2:00pm UTC](https://community.graylog.org/t/graylog-sidecar-doesn-t-send-logs/33887 "2024-10-28T14:00:45Z")
Hi, I´ve installed the latest Graylog server on debian and have installed sidecar agent on my windows machine. They are connected, running and the default configuration from setup is assigned: Collector is running. L… --- ## [Graylog Sidecar Tags](https://community.graylog.org/t/graylog-sidecar-tags/33910)
**Author:** [@jgrammen\_agility](https://community.graylog.org/u/jgrammen_agility)\ **Replies:** 0\ **Last updated:** [October 22, 2024, 2:30pm UTC](https://community.graylog.org/t/graylog-sidecar-tags/33910 "2024-10-22T14:30:02Z")
Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question. Don’t forget to select tags to help index your topic! 1. Describ… --- ## [Graylog Sidecar 1..5.2 - no messages in Graylog](https://community.graylog.org/t/graylog-sidecar-1-5-2-no-messages-in-graylog/33478)
**Author:** [@phalessummit](https://community.graylog.org/u/phalessummit)\ **Replies:** 2\ **Last updated:** [September 11, 2024, 4:23am UTC](https://community.graylog.org/t/graylog-sidecar-1-5-2-no-messages-in-graylog/33478 "2024-09-11T04:23:31Z")
Set up Graylog in Docker, able to log in and rsyslog → docker running perfectly Set up sidecar on two systems. They show up in sidecars but no data is arriving in Graylog. Debian 12 Graylog 6.0.5 Sidecar 1.5.0.2 Fol… --- ## [How to configure Windows filebeat dissect to understand "" marks and reads this as one field](https://community.graylog.org/t/how-to-configure-windows-filebeat-dissect-to-understand-marks-and-reads-this-as-one-field/33489)
**Author:** [@RaitHaavel](https://community.graylog.org/u/RaitHaavel)\ **Replies:** 0\ **Last updated:** [September 10, 2024, 3:25pm UTC](https://community.graylog.org/t/how-to-configure-windows-filebeat-dissect-to-understand-marks-and-reads-this-as-one-field/33489 "2024-09-10T15:25:53Z")
I have Windows sidecar installed and using filebeat to collect Microsoft Exchange logs to Graylog. Using dissect processor do extract log to fields. My conf: processors: - dissect: tokenizer: "%{date\_tim… --- ## [Sidecar - Configure sending logs to 2 servers](https://community.graylog.org/t/sidecar-configure-sending-logs-to-2-servers/33336)
**Author:** [@yumibad86](https://community.graylog.org/u/yumibad86)\ **Replies:** 1\ **Last updated:** [August 27, 2024, 3:35am UTC](https://community.graylog.org/t/sidecar-configure-sending-logs-to-2-servers/33336 "2024-08-27T03:35:47Z")
How do I configure sidecar to send log to 2 servers? I want you to send the logs via sidecar to 2 graylogs servers. My question is how do I configure the file “/etc/graylog/sidecar/sidecar.yml” and the Collector -Side… --- ## [Generating new Sidecar Token via API](https://community.graylog.org/t/generating-new-sidecar-token-via-api/33284)
**Author:** [@DoubleM](https://community.graylog.org/u/DoubleM)\ **Replies:** 4\ **Last updated:** [August 23, 2024, 9:08am UTC](https://community.graylog.org/t/generating-new-sidecar-token-via-api/33284 "2024-08-23T09:08:03Z")
Hi Community, we’re using Graylog actively since Version 4.1x and were really happy. As the environment got bigger, we’ve come up with the idea to automate as much as possible. We built a whole batch script to install … --- ## [Graylog sidecar error on windows 32bit](https://community.graylog.org/t/graylog-sidecar-error-on-windows-32bit/33244)
**Author:** [@qzvt](https://community.graylog.org/u/qzvt)\ **Replies:** 4\ **Last updated:** [August 15, 2024, 2:13am UTC](https://community.graylog.org/t/graylog-sidecar-error-on-windows-32bit/33244 "2024-08-15T02:13:38Z")
I’m try to install graylog-sidecar on windows server 32bit but I got this error. I have try version 1.2, 1.3, 1.4, 1.5 but no luck. I have download file from Releases · Graylog2/collector-sidecar · GitHub Anyone hav… --- ## [Messages not populating, files found in Graylog sidecars and filebeat in docker](https://community.graylog.org/t/messages-not-populating-files-found-in-graylog-sidecars-and-filebeat-in-docker/33213)
**Author:** [@sashah](https://community.graylog.org/u/sashah)\ **Replies:** 0\ **Last updated:** [August 7, 2024, 8:52pm UTC](https://community.graylog.org/t/messages-not-populating-files-found-in-graylog-sidecars-and-filebeat-in-docker/33213 "2024-08-07T20:52:22Z")
1. Describe your incident: I’m trying to ingest a log file in a docker environment using filebeat and graylog sidecar. I’ve managed to get the filebeat client container talking to the graylog host container, the sideca… --- ## [Mistake in documentation regarding sidecar silent install mode on Windows](https://community.graylog.org/t/mistake-in-documentation-regarding-sidecar-silent-install-mode-on-windows/32690)
**Author:** [@cesq](https://community.graylog.org/u/cesq)\ **Replies:** 0\ **Last updated:** [June 11, 2024, 9:15am UTC](https://community.graylog.org/t/mistake-in-documentation-regarding-sidecar-silent-install-mode-on-windows/32690 "2024-06-11T09:15:52Z")
Hi, linking this post as it’s what made me realise this and is an example of a user having problems because of a mistake in the docs → TLSSKIPVERIFY does not work when installing sidecar on Windows Documentation → Insta… --- ## [How to clean up inactive sidecars in the graylog web end](https://community.graylog.org/t/how-to-clean-up-inactive-sidecars-in-the-graylog-web-end/32675)
**Author:** [@hujiaxing1](https://community.graylog.org/u/hujiaxing1)\ **Replies:** 2\ **Last updated:** [June 11, 2024, 8:57am UTC](https://community.graylog.org/t/how-to-clean-up-inactive-sidecars-in-the-graylog-web-end/32675 "2024-06-11T08:57:42Z")
When I delete a server with sidecars configured, I want to delete inactive sidecars in the graylog, but there is no option to delete them. How can I delete inactive sidecars --- ## [Graylog Sidecar Winlogbeat Drop Event](https://community.graylog.org/t/graylog-sidecar-winlogbeat-drop-event/31957)
**Author:** [@f.s](https://community.graylog.org/u/f.s)\ **Replies:** 2\ **Last updated:** [June 8, 2024, 7:56am UTC](https://community.graylog.org/t/graylog-sidecar-winlogbeat-drop-event/31957 "2024-06-08T07:56:54Z")
Graylog Version: 5.2.0 Sidecar Version: 1.4.0-1 Hello, In order to save disk space in the future, I do not want to receive certain Windows events in the graylog. I have read that there is the possibility to specify “… --- ## [Nxlog sidecar collector and local nxlog service ARE able to run at the same time](https://community.graylog.org/t/nxlog-sidecar-collector-and-local-nxlog-service-are-able-to-run-at-the-same-time/32602)
**Author:** [@cesq](https://community.graylog.org/u/cesq)\ **Replies:** 2\ **Last updated:** [June 3, 2024, 1:02pm UTC](https://community.graylog.org/t/nxlog-sidecar-collector-and-local-nxlog-service-are-able-to-run-at-the-same-time/32602 "2024-06-03T13:02:21Z")
Looking at the documentation for setting up sidecar collectors and the docs state that before launching nxlog by graylog-sidecar you have to stop, disable and unconfigure the local nxlog instance: Because the Sidecar t… --- ## [TLSSKIPVERIFY does not work when installing sidecar on Windows](https://community.graylog.org/t/tlsskipverify-does-not-work-when-installing-sidecar-on-windows/32549)
**Author:** [@ClausSholler](https://community.graylog.org/u/ClausSholler)\ **Replies:** 2\ **Last updated:** [May 28, 2024, 11:43am UTC](https://community.graylog.org/t/tlsskipverify-does-not-work-when-installing-sidecar-on-windows/32549 "2024-05-28T11:43:42Z")
I can’t make TLSSKIPVERIFY key work when i install sidecar on Windows. Config is simple: graylog\_sidecar\_installer\_1.5.0-1.exe /S -SERVERURL=https://graylogserver/api -TLSSKIPVERIFY=true -TAGS=\["windows"\] -APITOKEN=api… [Next page](https://community.graylog.org/tag/sidecar/16.md?match_all_tags=true&page=1&tags%5B%5D=sidecar)