Hi, most likely the log message is not matching the pattern you try to use. We can't help you much more if you don't share the Grok pattern you are using, please share the contents of the "COMBINEDAPACHELOG" pattern as you see in the System -> Grok patterns page. Please also be aware that the message preview in the extractors page is collapsing duplicated white spaces, so that may also be a cause of problems.
Regards, Edmundo > On 02 Sep 2015, at 11:22, Vlaad P <[email protected]> wrote: > > Hi, > > Yes. And the same result. I have no errors on nodes. > P.S. Logs are shipped with rsyslog. Am I missing something? > > Thanks, > VP. > > On Tuesday, 1 September 2015 11:37:07 UTC+3, Jochen Schalanda wrote: > Hi, > > did you add the respective Grok patterns to your Graylog installation (System > -> Grok Patterns)? Are there any error messages in the Graylog server node > logs? > > > Cheers, > Jochen > > On Tuesday, 1 September 2015 10:34:55 UTC+2, VP wrote: > Hello, > > I have the following situation: > > Apache access log which is basically a %{COMBINEDAPACHELOG} > > 192.168.0.0 - - [31/Aug/2015:17:19:25 +0200] "POST > /application/path/get-updates-for-period HTTP/1.1" 200 1141 > "https://some.site.com/index.php"; "Mozilla/5.0 (Windows NT 6.1; WOW64; > Trident/7.0; rv:11.0) like Gecko" > > I'm trying to create an extractor using that message and the grok pattern, > but is not working. The error message is: > Attention > We were not able to run the grok extraction. Please check your parameters.e we > > Could someone help me? > > Many thanks! > > Regards, > VP. > > -- > You received this message because you are subscribed to the Google Groups > "Graylog Users" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion on the web visit > https://groups.google.com/d/msgid/graylog2/2bcdfe87-aa37-4a9b-a530-32d513bde5eb%40googlegroups.com. > For more options, visit https://groups.google.com/d/optout. -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/9A1642BD-45F2-4FFE-87D9-82BA4FB3E746%40graylog.com. For more options, visit https://groups.google.com/d/optout.
