Hi
I have the problem that right after adding a grok extractor to an input the
system immediately stopps sending messages to elasticsearch (out = 0). Does
somebody had the same experience?
My pattern looks like
"client\s%{IPV4:src_ip}#%{BASE10NUM:src_port}\s\(([a-zA-Z0-9.\-_]*)+\):\squery:\s%{NOTSPACE:dns_name}\sIN\s%{WORD:dns_type}\s%{NOTSPACE:dns_flags}\s\(%{IPV4:dns_server}\)"
and is for bind messages.
I have the latest 1.2.1 version installed. Graylog-server, -web and
elasticsearch are on different machines.
Thank you and kind regards
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/88f8a45e-8e14-4ec8-945a-4a47f4cad399%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
