[graylog2] setup ElasticSearch and Graylog

2015-10-14 Thread Zsolt Osztrovszky
Hello Guys! I've just installed ElasticSearch and Graylog to my debian. I've followed the docs (http://docs.graylog.org/en/1.2/pages/installation/operating_system_packages.html http://docs.graylog.org/en/1.2/pages/configuring_es.html) but it is still not working. I see that both of them are

[graylog2] Re: setup ElasticSearch and Graylog

2015-10-14 Thread Jochen Schalanda
Hi Zsolt, please post your Graylog server and your Elasticsearch configuration so we can take a look at them. Make sure to remove sensitive information like password_secret or MongoDB credentials before posting. Cheers, Jochen On Wednesday, 14 October 2015 16:27:25 UTC+2, Zsolt Osztrovszky

[graylog2] Re: Graylog: set default value with GROK

2015-10-14 Thread Jochen Schalanda
Hi, you could extract that string into a dedicated message field and then use quick values to come up with a pie chart (and data table) for that field. Cheers, Jochen On Wednesday, 14 October 2015 09:49:19 UTC+2, kaiser wrote: > > Hello, > > I would like to generate charts from string value:

[graylog2] Graylog: set default value with GROK

2015-10-14 Thread kaiser
Hello, I would like to generate charts from string value: "AUDIT_SUCCESS" I can't do that with strings. As a consequence, is there a way to set default value for the string AUDIT_SUCCESS to 1 with grok pattern? Regards. -- You received this message because you are subscribed to the Google

[graylog2] Re: Lost all previous data up on upgrade to 1.2.1-1

2015-10-14 Thread Abhishek Girme
Hi, I had 300 GB + data before upgrade. After upgrade disk usage came to 30 GB. No other activities were performed except an upgrade. On Tuesday, 13 October 2015 22:19:16 UTC+5:30, Jochen Schalanda wrote: > > Hi, > > the commands you've listed look good and shouldn't remove any data from >

[graylog2] graylog discovery timeout even though zen_ping_multicast is disabled

2015-10-14 Thread Remi Broemeling
Hi all, Just setting up a minimal stand-alone (read: single server) elasticsearch v1.7.2 and graylog v1.2.1 setup for the first time, and I've encountered something that I consider a little weird. Specifically, I am disabling zen auto-discovery on both sides, but it looks like graylog is

[graylog2] Re: Graylog: set default value with GROK

2015-10-14 Thread kaiser
Hi, thank you for your answer. Nevertheless this method will not allow to generate charts and for instance merge two graphs for AUDIT_SUCCESS and AUDIT_FAILURE. Regards Le mercredi 14 octobre 2015 11:46:16 UTC+2, Jochen Schalanda a écrit : > > Hi, > > you could extract that string into a