Re: [graylog2] VmWare esx 5 log format

2015-01-21 Thread Pete GS
We have vSphere 5.5 logs going to Graylog2 as well but ours go via a centralised Syslog server using rsyslogd and this works very well for us. I would highly recommend this configuration for getting vSphere logs into Graylog2 for two reasons... 1. The aforementioned issues with the log formats

[graylog2] Re: Export in CSV limited to 24001 rows

2015-01-21 Thread Paolo Larcheri
On Tuesday, November 25, 2014 at 12:55:26 AM UTC+1, Lifeonatrip wrote: > > When I am exporting search results in CSV format the maximum amount of > rows is always limited to 24001 even if my search result returns 2 million > messages. > Is this a limitation of the web interface to prevent crash

[graylog2] Re: Alert condition if field message contains string or matches regex

2015-01-21 Thread yveslouis . rofort
Hi Silvan, Got the same problem, have you find how to configure alert conditions to match a string or use a regex ? I tried with graylog2-web 0.92.4 and this morning with graylog2-web-interface-1.1.0-SNAPSHOT-20150115173058, without success. Thanks Regards Yves Louis Le dimanche 23 novembre

[graylog2] Using selected fields for an email alert callback

2015-01-21 Thread Ronald Rink (d-fens GmbH)
Hi Ubay, as far as I know this is not possible out of the box. Therefore I wrote a plugin that can execute any scripts (e.g. javascript) you define. The script will get the message as an input parameter, from where you can e.g. send an email with only the fields you need. I originally built this

[graylog2] [ANNOUNCE] Graylog v1.0.0-beta.3 has been released

2015-01-21 Thread Kay Röpke
Hello folks! We are happy to announce that we just released the third beta version of Graylog v1.0. The project is about to reach the 1.0-final milestone after five years of development. Please see https://www.graylog2.org/news/post/0018-graylog-v1-0-0-beta3 for details and a download link. Y

Re: [graylog2] Re: LVS + keepalived + UDP + HTTP_GET

2015-01-21 Thread Tristan Rhodes
Just for fun, this should be an equivalent setup using HAProxy: (If you are a HAProxy guru, please correct this) backend graylog2 mode http balance roundrobin option httpchk GET /system/lbstatus/ http-check expect status 200 server web1 10.0.0.10:12900 check server web2 10

Re: [graylog2] Re: LVS + keepalived + UDP + HTTP_GET

2015-01-21 Thread Tristan Rhodes
I didn't see him specify that he was using GELF format for his logs. I think this is a load-balancer configuration problem. Here are the values you can check with a load-balancer: "The status knows two different states, ALIVE and DEAD, which is also the text/plain response of the resource. Addit

[graylog2] Re: LVS + keepalived + UDP + HTTP_GET

2015-01-21 Thread Jochen Schalanda
Hi, On Wednesday, 21 January 2015 15:23:01 UTC+1, kutscher wrote: > > Hello, i want to use Loadbalance UDP Syslog Messages to the Graylog2 > Nodes. > Unfortunately that won't be possible because of the chunking mechanism being used when submitting GELF messages via UDP because all chunks must

[graylog2] LVS + keepalived + UDP + HTTP_GET

2015-01-21 Thread kutscher
Hello, i want to use Loadbalance UDP Syslog Messages to the Graylog2 Nodes. But the Healthcheck of the HTTP do not work. I want to use UDP - Use Keepalived + LVS but the HTTP_GET Healthcheck do not work for me. If I do not use the HTTP_GET flag its work very (https://www.graylog2.org/res

[graylog2] Using selected fields for an email alert callback

2015-01-21 Thread Ubay
Hi, Sometimes i don't wat to include the full message in the email alert, just a few fields. Is it possible to include only selected fields? Thanks in advance. -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and

[graylog2] Re: Active Directory Authentication

2015-01-21 Thread Jochen Schalanda
Awesome. Thanks for sharing! On Wednesday, 21 January 2015 06:00:48 UTC+1, Pete GS wrote: > > Tom, I know this is an old post but did you ever get this solved? > > I had the same issue and have resolved it so I'll post the solution here > in case it is the same... > > Essentially the issue for us