Hi Mark,
you can create a stream containing all messages (e. g. by checking for the
presence of the timestamp or message fields) and allow all users to read
that stream (but not edit it). This way users can query for all messages
(in that stream) but cannot modify anything.
Cheers,
Jochen
On
ALL messages are relevant to every user. And unless I don't have a firm
grasp of Streams, I found that option unacceptable. So I set up a second VM
with full search but no way to mess with the archived data or delete inputs
by mistake.
On Tuesday, June 16, 2015 at 1:18:53 AM UTC-7, Jochen
Hi Mark,
you could probably create read-only users and assign them to a stream with
messages relevant to them.
Cheers,
Jochen
On Monday, 15 June 2015 21:28:01 UTC+2, Mark Moorcroft wrote:
And if I could link to the master mongoDB then obviously that would
defeat the point of giving search
Hi Mark,
input configurations are being stored inside MongoDB and are linked to the
node ID. If your slave Graylog instance is either using another node ID
or isn't able to access the MongoDB with the input configurations, you'll
see the message (deleted input on outdated node) in the web
And if I could link to the master mongoDB then obviously that would
defeat the point of giving search ability to users without making them an
admin on the master?
On Monday, June 15, 2015 at 6:17:23 AM UTC-7, Jochen Schalanda wrote:
Hi Mark,
input configurations are being stored inside
