Graylog when use multiple input (use case)

Question

When should I use multiple input for my graylog? Do you have a use case?

For instance, I have different Symfony (3.x) applications with different environments (integration, prod, ..) and I want all of them into my graylog.

What is the best way (or the bests pratices) to send all of them into my graylog and easily crate stream based on this environments?

Are you still waiting on an answer? There are some sufficient answers below. Have you tried these? — hmiedema9, Aug 30 '18 at 19:15

score 1 · Accepted Answer · answered Aug 29 '18 at 15:01

1

The way I always understood this is that you create separate inputs for "kinds of logs". Like: one rsyslog input for all machines sending logs in rsyslog format, second for all GELF applications, third for capturing NetFlow, etc.

answered Aug 29 '18 at 15:01

Piohen

1,514
15
23

Ok but is there bests practices or something like that? – PapaSku Sep 03 '18 at 13:00
But I think you're right because when I want to create an input, it ask me for the format of the input. So you win – PapaSku Sep 03 '18 at 16:15

score 0 · Answer 2 · answered Aug 29 '18 at 14:54

0

You can send logs from an arbitrary number of applications and systems (i.e. environments) to Graylog (even on the same input).

Simply configure your applications and systems to send logs to Graylog and create an appropriate input for them.

See http://docs.graylog.org/en/2.4/pages/sending_data.html for some hints.

answered Aug 29 '18 at 14:54

hmiedema9

948
4
17

I know how to send log, this is not the question. I want to know why we can create differents inputs and when use it. – PapaSku Sep 03 '18 at 12:59
This answer is essentially the same to the one that won the bounty - configure your application/sys logs to send to Graylog, then create an input for them... – hmiedema9 Sep 04 '18 at 13:36

Graylog when use multiple input (use case)

2 Answers2