61–67 of 67 posts
Hurrah - good to see that the Elasticsearch dependency is no longer locked to a rather old version (that bit me a few times when setting up a cluster last year). I'm still a bit wary about having to spin up MongoDB for it as well, though…
The MongoDB requirement gives me pause, too. I've wanted to give ToroDB ( https://github.com/torodb/torodb ) a try for awhile now, and I think I'm going to see if Graylog will talk to it for grins.
Is there any way to not use MongoDB in the backend?
I had the same question. Why are they using MongoDB when Elasticsearch can do the same job, may be better.
That being said, we're aware that many people don't like the dependency on MongoDB and we'll work on that.
Earlier quoted context omitted.
We decided to drop the "2" from the name to have less confusion with "Graylog(2) 2.0" - Point taken here, the initial "2" was not a good idea :D (The documentation may need a "History" page)
No Graylog3?
What other pieces of software are there in this class? Who are the competitors?
Earlier quoted context omitted.
No Graylog3?
As Men in Black 3 wasn't that great and Star Wars: Episode 3 also had its lengths (don't get me started about Lethal Weapon 3!), we tried to avoid that. Let's see how Ghostbusters 3 will work out and maybe (but just maybe) we'll think about releasing Graylog3. ;-)
What other pieces of software are there in this class? Who are the competitors?
Their search interface and field extraction let you perform complex queries on your logs. We used the following query to identify users that were having a bad time on the site, by counting slow queries by user and adding them up:
"slow query" source="/var/log/application.log" | rex field=_raw "in (?\\d+)ms" | search time>2000 | rex field=_raw "User: (?[^\\s]+) " | top login
You can do much more complex queries--it's better to think of Splunk as a temporal database than a log aggregator.
Does anyone know if Graylog or other logging solutions can do the same thing? Splunk is amazing, but it's annoying to manage the infrastructure and it's crazy expensive.
I'm evaluating Graylog as a piece in our monitoring infrastructure. Does anybody have some experience using it in production?
Honestly, I have no idea what we did before we started using it. It's an absolutely essential tool.