0

We have several office locations, each office has its own Graylog server which is working great.

We want to set our head office to collect all the logs/messages that are stored on the sub office Graylog servers.

So in effect each sub office Graylog server will store only its own sub office messages but the head office will store all messages from every sub office.

Can this be done by only having the Graylog servers in the sub office send its messages to the master in Head office? I do not want to have to replicate all the individual inputs on the master - just one input that comes from each sub office Graylog server.

If this is possible can you please advise how I can set this up or point me to the doco - I have read through the Graylog docs and can only see a setup to have multiple Graylog servers in the same site to share the load.

Thank you in advance for your replies.

Rob
  • 95
  • 5

1 Answers1

0

Ok with a bit more reading I worked this out and it is very simple.

Just create a Stream on the Sub office containing the messages you want to send to the HO.

Then attach an Output to that stream.

On the HO server simply create an input which reads the output from the sub office server.

This works out much better than sending all data as you can have all logs stored on the sub office and only the important messages sent to the HO server.

Rob
  • 95
  • 5