Hi Ben,
Not sure for a good example, but it works :)
Event Type: %{WORD:event_type}, Event Name: %{WORD:event_name}, Device
Name: %{WORD:device_name}, File Path: %{DATA:file_path}, Interpreter:
%{WORD:interpreter}, Interpreter Version: %{DATA:interpreter_version}, Zone
Names: %{GREEDYDATA:zone_names}
On Tuesday, October 18, 2016 at 9:53:04 PM UTC+3, Ben Sooter wrote:
>
> Has anyone seen any good examples of how to parse messages that come in
> like this? It is comma delimited, and has spaces all over the place.
> Thanks!
>
> Event Type: ScriptControl, Event Name: Alert, Device Name: USXXMON01, File
> Path: c:\programdata\pview3\administrator\pviewagent-748.mdb, Interpreter:
> MacroScript, Interpreter Version: 14.0.7162.5001, Zone Names: (FieldServers)
>
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/52ae3daf-0fe3-467e-af8b-6f1fa660a7eb%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
