Currently we have a cluster of Graylog/ES nodes that is strictly taking UDP GELF log messages as input. We are noticing high amount of large log messages being injected into the data nodes and would like to track down which of the messages are unusually large. My search for a solution first brought me to ES mapper size plugin. However, after digging deeper, I realized that the mapping for the indices are managed by Graylog so having the plugin didn't really offer me a solution. After raising the question with Graylog on Github, I was told that a Custom Index Template is what I need. I did a read up on https://www.elastic.co/guide/en/elasticsearch/reference/2.3/indices-templates.html article. I get the idea of what it is doing, though I am still not clear on how to properly configure this. It does not appear there are any way to directly create/modify a template in the frontend. Can anyone provide some guidance on how I can implement this in our environment without changing our existing logging capabilities?
-- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/e38bf596-9184-4e4a-9941-369ffd65694a%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
