Graylog：跨环境迁移Graylog配置方案咨询

Great question! Graylog absolutely supports exporting and importing configurations like Inputs and Streams—let’s break down the easiest, most reliable ways to sync your test setup to production without those annoying manual errors.

This is the go-to method for most teams since it’s visual and doesn’t require any command-line work.

Export from Test Environment #

• For Inputs:
  1. Log into your test Graylog instance and navigate to System > Inputs
  2. Select the input(s) you want to move, click the three-dot dropdown menu next to them, and choose Export
  3. Save the generated JSON file to your local machine (it’ll include all extractors and settings tied to that input)
• For Streams:
  1. Go to the Streams section in the sidebar
  2. Click on the stream you want to export, then switch to the Manage Stream tab
  3. Look for the Export Stream Configuration button, download the JSON file (this includes stream rules, index set associations, and permissions)

Import to Production Environment #

• Repeat the same navigation steps in your production Graylog instance, but select Import instead of Export
• Upload the saved JSON files, take a minute to review the configuration (pay extra attention to input ports—test ports might conflict with production services!), then confirm the import

If you need to sync configurations regularly or handle bulk exports/imports, the API is your best bet. You can script these commands to avoid manual work entirely.

Export Commands (Test Environment) #

Replace admin:your_test_password, test-graylog:9000, and {input-id}/{stream-id} with your actual test instance details:

• Export a single input:

  curl -u admin:your_test_password -X GET http://test-graylog:9000/api/system/inputs/{input-id} > test-input-config.json
  

• Export a single stream:

  curl -u admin:your_test_password -X GET http://test-graylog:9000/api/streams/{stream-id}/export > test-stream-config.json
  

Import Commands (Production Environment) #

Swap out for your production credentials and instance URL:

• Import an input:

  curl -u admin:your_prod_password -X POST http://prod-graylog:9000/api/system/inputs -H "Content-Type: application/json" -d @test-input-config.json
  

• Import a stream:

  curl -u admin:your_prod_password -X POST http://prod-graylog:9000/api/streams/import -H "Content-Type: application/json" -d @test-stream-config.json
  

Don’t skip these—they’ll save you from post-import headaches:

• Input Ports & Network Bindings: Test environments often use non-standard ports that might already be in use in production. Adjust these in the JSON file or during import if needed.
• Index Sets: Streams are linked to specific index sets. Make sure the target index set exists in production, or edit the stream’s JSON to point to a valid production index set before importing.
• Permissions & Roles: If your inputs/streams are tied to specific user roles, ensure those roles exist in production (or export/import the roles first via System > Roles).
• Extractors & Pipelines: If your inputs use extractors, or streams rely on processing pipelines, don’t forget to export/import those too (found under System > Extractors and System > Pipelines).

Personally, I’d start with the Web UI for your first sync—it’s easy to verify each config before pushing to production. If you find yourself doing this regularly, scripting the API calls will become a huge time-saver and eliminate human error entirely.

内容的提问来源于stack exchange，提问作者Piotr