Thanks, Jochen, I perhaps didn't make myself clear in my question - I have a number of Graylog collectors running on different instances and my question was more whether I should create a separate input on a distinct port for each of these collectors or just create one input and have all the collectors send to that one input.
In the end, I went with the second approach, so I have one GELF TCP input started on port 12201, which aggregates the data from all the collectors. I then have created a number of streams to route the incoming data, where they can be separated by log (and application) type. I preferred this approach as it meant from a security point of view, I only had to open one more port and the 'Streams' concept allowed me to segment my log messages. Seán On Tuesday, 1 December 2015 16:41:40 UTC, Sean McGurk wrote: > > Hi there, > > I have set up a Graylog server with a number (7) of input sources. > > My question is, when configuring Graylog, is it better to open a number of > ports on the Graylog server and have each port receive messages from a > particular source or is it better to only open 1 port and receive all > inputs via this 1 port? > > Thanks, > > Seán > > > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/7c662b78-65ee-4eb0-8186-551b63147d5f%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
