Yeah, on a semantics level, you are right. 2 different inputs, but with the same name and same port.
But, something is up. With the new input active, Graylog is ingesting the new data as a deleted input, instead of tagging it as a valid input. How can I troubleshoot what is going on? I tried creating another input, with the same name, but with a different port. I'm still having the same problem. New data is showing up and is being sent to Elastic, but it is showing up as Received by 'deleted input' in the main search. There's gotta be a disconnect somewhere on the process of deleting inputs. I can help to diagnose and track down the bug if you can tell me what to look for. Jas On Tuesday, December 13, 2016 at 11:46:57 AM UTC-6, Jochen Schalanda wrote: > > Hi Jason, > > On Tuesday, 13 December 2016 17:16:37 UTC+1, Jason Close wrote: >> >> I then deleted it, and later came back and recreated that same input. >> >> Now, I cannot get data to show up when I query the received messages for >> that input, no matter the time range. >> > > You didn't create the same input, you created a new input with the same > name and probably the same settings. But it's not the same input. > > >> Is it possible that something is not getting properly updated or deleted >> within the config of Graylog that tells it which input buffer to look in? >> > > No, everything is working as intended, as far as I see. > > > Cheers, > Jochen > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/f5fe9d18-6fbc-45df-8573-dd233d680387%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
