[graylog2] [ANN] Graylog2 0.92.1-rc.1 released

2014-12-09 Thread Jochen Schalanda
Hi, we just released Graylog2 0.92.1-rc.1 to fix some bugs that had slipped into the Graylog2 0.92.0 release. Thanks to everyone who reported bugs in the last release via GitHub, via the mailing list, and on IRC! This is strictly a bugfix release. No new features have been introduced. If no sh

[graylog2] Re: ClusterBlockException[blocked by: [FORBIDDEN/8/index write (api)] when deleting data by query through api

2014-12-09 Thread pmiles . mail
Bump .. anyone ? -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.

Re: [graylog2] Drools with accumulate and window:time. Anyone?

2014-12-09 Thread Kay Röpke
It's tricky, because one 10 minute sliding window will destroy the server process when faced with any significant load. If we are to support this kind of analysis it will probably look completely different. Personally I would like to get rid of drools altogether in the future and replace it with

Re: [graylog2] Drools with accumulate and window:time. Anyone?

2014-12-09 Thread Dmitri Stoljarov
Hi, Any plans to have something similar in future releases of Graylog2? On Tuesday, December 9, 2014 2:33:12 PM UTC+2, Kay Röpke wrote: > > Hi! > > The embedded drools is not enabled to do streaming operations. > Mostly because it uses really insane amounts of memory and probably will > be out o

Re: [graylog2] Drools with accumulate and window:time. Anyone?

2014-12-09 Thread Kay Röpke
Hi! The embedded drools is not enabled to do streaming operations. Mostly because it uses really insane amounts of memory and probably will be out of memory soon. Best, Kay On Dec 9, 2014 1:28 PM, "Dmitri Stoljarov" wrote: > Hi, > > Does anyone build some advanced drools, where you accumulate d

[graylog2] Drools with accumulate and window:time. Anyone?

2014-12-09 Thread Dmitri Stoljarov
Hi, Does anyone build some advanced drools, where you accumulate data over some time? Here's nice example http://ouce.opennms.eu/system/attachments/25/original/log_correlation.pdf Tried to build something similar for graylog2, but no luck. Any drool gurus here? -- You received this message

Re: [graylog2] varnish and varnishncsa UDP log pipe

2014-12-09 Thread 'Razvan Grigore' via graylog2
On Tuesday, December 9, 2014 11:05:44 AM UTC+1, Razvan Grigore wrote: > and if you restart the daemon, it parses again all entries in the log file > and sends them once again to graylog. > Ah, scratch that, the daemon had no write rights to save the state file, it works great now, but he shoul

Re: [graylog2] varnish and varnishncsa UDP log pipe

2014-12-09 Thread 'Razvan Grigore' via graylog2
Hey Martian, I think I solved the problem, it was the 'output_batch_size = 25' so the output buffer was always full and writing to disk, and he never managed to write all logs into elasticsearch. I also raised the 'net.core.rmem_max' limit because in debian is 200k by default (thanks Arie) I t

Re: [graylog2] Re: Changes in 0.92 for GELF TCP Input ?

2014-12-09 Thread Florent Bautista
Hi Jochen, This is not exactly my problem :) My radio node in 0.91.3 has an GELF TCP Input, and all is working fine with server in 0.92. My problem occurs when I upgrade radio to 0.92, it does not process messages from my GELF Input :( On 12/08/2014 02:50 PM, Jochen Schalanda wrote: > Hi Flor