1. Gravwell Help Center
  2. Setup and configuration

I have installed certificates on our indexers and successfully configured the ingestors to talk TLS to the indexers. Should I comment out the ClearText entries to 4023? Am I receiving logs twice?

You're not receiving logs twice, but you should comment that out.

If you setup TLS and have not yet commented out ClearText entries yet you will see two connections in the Gravwell console to each indexer for each port (4023/4024).

You will also see it connect to both tcp:// and tls:// in the ingestor logs, however you are NOT receiving logs twice. The duplicate connections just means that the logs are load balanced across those two connections.  So, the logs are not duplicated, but some fraction are not flowing through an encrypted pipe.

To clear up the issue you will want to comment out the non-TLS connections.