Hi Alexandre, is there anything wrong with running different inputs for different kind of log messages in your opinion?
The general format of GELF message is: > @timestamp > @version > level > container_name > conainter_id > image_name > message (content can be JSON, Apache or Tomcat format) > ... other fields That doesn't look like GELF to me. The @timestamp and @version fields indicate that this is normal JSON similar to the format Logstash is expecting. I'd recommend sending proper GELF messages if possible. Cheers, Jochen On Saturday, 30 July 2016 21:04:09 UTC+2, Alexandre Verri wrote: > > I need to handle multiple log formats: JSON, Apache and Tomcat format. It > is very easy to handle each of them separately using JSON Extractor and > Grok pattern. > > But how to handle all of them in the same input? I have a GELF Input that > receives these 3 types of log formats. > > The general format of GELF message is: > > @timestamp > @version > level > container_name > conainter_id > image_name > message (content can be JSON, Apache or Tomcat format) > ... other fields > > For the JSON format, I need to rename the field 'level' to 'log_level' in > order to avoid clashing with the GELF field with the same name. > > Could you please provide an example how to handle this? > > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/a4f58c31-6622-4eff-8956-c2186690b05e%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
