OK looks like I missed a step. I created the outputs as below but then I had to go to Streams and attach the output to a stream.
So I created a stream that has a rule which gets all messages from the source I want on the sub office and attached my output and now I see the sub office messages on the Head Office server. I will add more sub office servers and see how it goes. Than you Jan for pointing me in the right direction - much easier than I originally thought. On Tuesday, 17 May 2016 09:28:54 UTC+10, Rob wrote: > > We have several office locations, each office has its own Graylog server > which is working great. > > > We want to set our head office to collect all the logs/messages that are > stored on the sub office Graylog servers. > > > So in effect each sub office Graylog server will store only its own sub > office messages but the head office will store all messages from every sub > office. > > > Can this be done by only having the Graylog servers in the sub office send > its messages to the master in Head office? I do not want to have to > replicate all the individual inputs on the master - just one input that > comes from each sub office Graylog server. > > > If this is possible can you please advise how I can set this up or point > me to the doco - I have read through the Graylog docs and can only see a > setup to have multiple Graylog servers in the same site to share the load. > > > I only need the Head Office to be able to search all sub office messages - > each individual sub office only needs access to their own messages. > > > I had a look here and possibly this is something that might something I > can use but the thread never ended with a full solution: > > > > https://groups.google.com/forum/#!searchin/graylog2/send$20graylog$20messages$20to$20another$20graylog$20server/graylog2/yZFX7XkLhTU/m6Ku_Eyq29cJ > > > Thank you in advance for your replies. > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/23b241f5-babf-4205-9b6c-a4b3076d23e8%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
