Hello
Found the issue, it was the configuration of NXLOG, I had to tell NXLOG
that the input was multiline and the headline/endline were {}, I changed
the nxlog.conf as below:
<Extension gelf>
Module xm_gelf
</Extension>
<Extension multiline>
Module xm_multiline
HeaderLine /^{/
EndLine /^}/
</Extension>
<Input in>
Module im_file
File "/media/winlogs/*"
SavePos TRUE
Recursive TRUE
InputType multiline
</Input>
<Output out>
Module om_udp
Host 127.0.0.1
Port 12201
OutputType GELF
</Output>
#<Output out>
# Module om_file
# File "/tmp/output"
#</Output>
On Sunday, May 31, 2015 at 1:49:06 AM UTC+10, [email protected] wrote:
>
> Hello
>
> I'm having a problem with graylog and nxlog feed
>
> I have a huge archive of windows event logs, I have been trying to import
> these logs into graylog using nxlog and gelf
>
> It all works well, nxlog pickup the logs and imports them but the messages
> are being split in several records rather tha a single one,
>
>
> Example if the event log contains the follow
>
>
> *{"1331892664000, 4624, "Success", "Security",
> "Microsoft-Windows-Security-Auditing", "An account was successfully logged
> on.*
>
> *Subject:*
> * Security ID: S-1-0-0*
> * Account Name: -*
> * Account Domain: -*
> * Logon ID: 0x0*
>
> *Logon Type: 3*
>
>
> *This event is generated when a logon session is created. It is generated
> on the computer that was accessed.*
>
> *Key length indicates the length of the generated session key. This will
> be 0 if no session key was requested." "} *
>
>
> It gets loaded into graylog as:
>
> Record 1: *{"1331892664000, 4624, "Success", "Security",
> "Microsoft-Windows-Security-Auditing", "An account was successfully logged
> on.*
> Record 2: *Subject*
> Record 3*: **Security ID: S-1-0-0*
>
> etc.
> etc
>
>
> I just would like to have all the message stored in one record
>
> Do you have any idea how this could be achieved?
>
> Thanks!
> Mark
>
>
>
>
>
>
--
You received this message because you are subscribed to the Google Groups
"graylog2" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
