<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Does not look like I’m getting data into es. How could I tell does <b class="">data=false</b> mean it’s not storring ? </div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">tail -f /var/log/elasticsearch/syslog-ng.log while restarting syslog-ng. </div><div class=""><div class=""><br class=""></div><div class="">[2016-04-13 12:21:26,762][INFO ][cluster.service ] [NODE-1] removed {{NODE-1}{K0_nu3-4TKKjPQfoMUlOhw}{127.0.0.1}{127.0.0.1:9301}{client=true, data=false},}, reason: zen-disco-node_left({NODE-1}{K0_nu3-4TKKjPQfoMUlOhw}{127.0.0.1}{127.0.0.1:9301}{client=true, data=false})</div><div class="">[2016-04-13 12:21:34,440][INFO ][cluster.service ] [NODE-1] added {{NODE-1}{mXgtXGW3Raai_L7GEdxLVQ}{127.0.0.1}{127.0.0.1:9301}{client=true, data=false},}, reason: zen-disco-join(join from node[{NODE-1}{mXgtXGW3Raai_L7GEdxLVQ}{127.0.0.1}{127.0.0.1:9301}{client=true, data=false}])</div></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><br class=""><div><blockquote type="cite" class=""><div class="">On Apr 13, 2016, at 11:38 AM, Fabien Wernli <<a href="mailto:wernli@in2p3.fr" class="">wernli@in2p3.fr</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">On Wed, Apr 13, 2016 at 11:32:47AM -0400, Scot Needy wrote:<br class=""><blockquote type="cite" class="">NOTE: I do not believe some options like server,port,.. are needed in node mode. <br class=""></blockquote><br class="">correct: in node mode, almost everything is in the yaml<br class=""><br class=""><blockquote type="cite" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>What is the relationship to the ES service and syslog-ng in node mode?<br class=""></blockquote><br class="">No direct relation in any mode: the ES data node runs in a different JVM on<br class="">same or other node.<br class=""><br class=""><blockquote type="cite" class="">It looks like in node mode the es2 module write directly to the shard ? <br class=""></blockquote><br class="">Yes, syslog-ng runs an ES instance itself that joins the cluster of the<br class="">other ES instance(s). It writes documents directly to the correct nodes.<br class=""><br class=""></div></blockquote></div><br class=""></body></html>