True... however I missed some details in my original post... Our sources are Syslog, Windows event logs (via NXLog), and other application logs (also via NXLog), so a Syslog only server won't cater for the others.
Under 0.9x I was thinking a Graylog2 Radio setup would work for this but now it's deprecated so I'm probably leaning more towards using Kafka somehow for this. I've never used a message broker so I'm not sure how this would be implemented, but perhaps a message queue per Graylog input? That way I could set the same extractors on the equivalent Kafka input for the native syslog/GELF inputs I have already. Cheers, Pete On Friday, 20 March 2015 18:34:43 UTC+10, Henrik Johansen wrote: > > Well - a very uncomplicated solution would be to log to a local > syslog server (any would probably do) and then use the im_file > input in nxlog to ship them to your Graylog setup over TCP. > > On 20 Mar 2015, at 05:51, Pete GS <[email protected] <javascript:>> > wrote: > > Hi all, > > We're looking at adding message sources into our Graylog setup from a > couple of remote sites. There is the possibility of temporary transit link > outages so sending UDP packets would result in lost messages. Using TCP > will counter this to a certain extent but may result in messages queuing on > sources running NXLog etc. which we would like to avoid. > > I'm think it would be better to set up a message broker at the remote site > and having Graylog subscribe to this to retrieve the messages instead once > the link is available again. > > Does this sound like a sensible idea or is there some better way to > achieve this? > > Any recommendations on a preferred message broker etc.? > > Any clues on how to get NXLog, Syslog, etc. to log to a message broker > instead of to Graylog directly? > > Cheers, Pete > > -- > You received this message because you are subscribed to the Google Groups > "graylog2" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected] <javascript:>. > For more options, visit https://groups.google.com/d/optout. > > > -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
