This works well for me. I need to give a bunch of staff read access to everything in Graylog, so I have created a stream "CatchAll" with the rule simply that the message field is present.
I then grant the necessary users view access on the CatchAll stream and it seems to work well. The only catch with this method has been the lack of the Search bar by default but I haven't asked anyone if this has changed in 1.1.2 (I have Admin rights). The users are used to searching via Streams so it's not an issue that I'm aware of. Hope that helps. Cheers, Pete On Wednesday, 17 June 2015 18:01:13 UTC+10, Jochen Schalanda wrote: > > Hi Mark, > > you can create a stream containing all messages (e. g. by checking for the > presence of the timestamp or message fields) and allow all users to read > that stream (but not edit it). This way users can query for all messages > (in that stream) but cannot modify anything. > > Cheers, > Jochen > > On Tuesday, 16 June 2015 19:28:08 UTC+2, Mark Moorcroft wrote: >> >> >> ALL messages are relevant to every user. And unless I don't have a firm >> grasp of Streams, I found that option unacceptable. So I set up a second VM >> with full search but no way to mess with the archived data or delete inputs >> by mistake. >> >> On Tuesday, June 16, 2015 at 1:18:53 AM UTC-7, Jochen Schalanda wrote: >>> >>> Hi Mark, >>> >>> you could probably create read-only users and assign them to a stream >>> with messages relevant to them. >>> >>> Cheers, >>> Jochen >>> >>> >>> -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
