Hi Jochen, thanks a lot for your response but is it only index prefix problem or format also? So if I change my index prefix on logstash in graylog2_*, all should work fine. Ciao Alberto
On Monday, May 18, 2015 at 1:05:23 PM UTC+2, Jochen Schalanda wrote: > > Hi Alberto, > > the indexed message format used by Graylog is different from the format > used by logstash. Additionally, Graylog only uses indices which start with > the configured index prefix ( > https://github.com/Graylog2/graylog2-server/blob/1.0.2/misc/graylog2.conf#L138-139). > > In other words, you cannot use indices created and filled by logstash with > Graylog. > > > Cheers, > Jochen > > On Monday, 18 May 2015 12:30:57 UTC+2, Alberto Frosi wrote: >> >> Hi all, >> >> I have a problem to display in my graylog data from elasticearch. >> In ES seems all fine: >> >> curl -XGET http://localhost:9200/_cat/shards >> graylog2_897 0 p STARTED 507724 98.6mb 127.0.1.1 Wilbur Day >> graylog2_897 3 p STARTED 501912 97.4mb 127.0.1.1 Wilbur Day >> graylog2_897 1 p STARTED 501830 97.5mb 127.0.1.1 Wilbur Day >> graylog2_897 2 p STARTED 496470 96.5mb 127.0.1.1 Wilbur Day >> logstash-2015.05.18 0 p STARTED 11 26.4kb 127.0.1.1 Wilbur Day >> logstash-2015.05.18 3 p STARTED 11 26.9kb 127.0.1.1 Wilbur Day >> logstash-2015.05.18 1 p STARTED 16 30.5kb 127.0.1.1 Wilbur Day >> logstash-2015.05.18 2 p STARTED 16 27.2kb 127.0.1.1 Wilbur Day >> graylog2_898 0 p STARTED 509026 98.5mb 127.0.1.1 Wilbur Day >> graylog2_898 3 p STARTED 500805 96.9mb 127.0.1.1 Wilbur Day >> >> >> logstash-2015.05.18 It's the index name from logstash agent. >> >> In graylog I don't display anything from this index... >> >> Why? >> Thanks a lot in advance >> >> Alberto >> > -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
