Hi, Also, I tried using the elasticsearch_config_file setting in Graylog > config to make it point to /etc/elasticsearch/elasticsearch.yml but then > I ran into the problem described here, so I had to roll back: > https://groups.google.com/forum/#!topic/graylog2/PvP2BYNe0xg
Sounds like you tried to use the configuration file for your normal Elasticsearch node(s) with Graylog. That won't work. You have to use a configuration file which only contains the bare minimum of what you want to change for the Elasticsearch client node used inside Graylog. Many options are also overridden by Graylog directly (see configuration settings prefixed with elasticsearch_ in the Graylog configuration file). Cheers, Jochen On Tuesday, 28 July 2015 15:21:32 UTC+2, ZeroUno wrote: > > Il 28/07/15 14:13, Jochen Schalanda ha scritto: > > > you can add your index template to the Elasticsearch configuration file > > ( > https://www.elastic.co/guide/en/elasticsearch/reference/0.90/indices-templates.html#config) > > > > referenced in the elasticsearch_config_file setting in the Graylog > > configuration file > > Thanks, but the link you posted just talks about putting the template > file into the config/templates directory, which is what I already did, > > Also, I tried using the elasticsearch_config_file setting in Graylog > config to make it point to /etc/elasticsearch/elasticsearch.yml but then > I ran into the problem described here, so I had to roll back: > https://groups.google.com/forum/#!topic/graylog2/PvP2BYNe0xg > > Anyway, I found the problem: my template file was missing a comma before > "message", sorry :-P. I should have looked better at the logs. > > So now as far as I can see my template file is working fine, I can even > only use the "message" mapping without the need to add the "_default_" > one. > Apart from this, I added the indices.ttl.interval setting in > elasticsearch.yml, this should tell it how often expired documents must > be deleted, e.g. "7d" for 7 days. > > -- > 01 > > -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
