Re: [graylog2] Multiple source IP addresses to one Stream group - HOW? POSSIBLE? A BETTER WAY?

Exactly :) Also keep in mind that messages can exist in multiple streams since it’s just a form of tagging and filtering. If you really, really need to use the approach you outlined there a 2 options - one would be to vote for the implementation of issues #381 and #382 another would be to

[graylog2] Re: exporting data from searches not working properly

Hello Found the issue as well, only the message is by default exported so I had to create an extractor to override the default message with the full message I used the split and index, using { as splitting characters Thanks! Mark On Sunday, May 31, 2015 at 1:49:07 AM UTC+10,

Re: [graylog2] Graylog 1.1.0-beta.2 collector issue in webinterface

Bernd, looks like it is solved in 1.10.4-rc1. Thank you. On Thursday, May 28, 2015 at 5:54:33 PM UTC+2, Bernd Ahlers wrote: Arie, thanks for he report. There is an issue and a pull request to fix the issue on GitHub. https://github.com/Graylog2/graylog2-web-interface/issues/1334

[graylog2] Re: Multiple source IP addresses to one Stream group - HOW? POSSIBLE? A BETTER WAY?

Hi Brandon, I see now what you and Henrik mean. That’s a far more suitable solution and one I will start to have a look at. My original approach / mind-set wasn`t correct. Thanks for yours and Henriks help. I`ve been playing with graylog for about 10 days on and off now and loving it!

Re: [graylog2] Re: grok extractors not working

Jesse, We've just tried to reproduce this issue on 1.1.0-RC.1 but it works as expected. Could you give that a try in a test environment, please? Thanks, Kay On Saturday, 30 May 2015 13:42:52 UTC+2, Bernd Ahlers wrote: Jesse, thank you for the update. I created an issue in GitHub for this

Re: [graylog2] Multiple source IP addresses to one Stream group - HOW? POSSIBLE? A BETTER WAY?

Thanks Henrik. Lol - I remember a crazy party with lots of crazy zabbix guys and lots of champagne! I never found the ring and I am now on my forth in five years! regards On Monday, June 1, 2015 at 7:25:21 AM UTC+1, Henrik Johansen wrote: Exactly :) Also keep in mind that messages

Re: [graylog2] Re: grok extractors not working

Thanks to everyone for continuing to pursue this odd issue. Arie - We are using nxlog-ce version 2.9.1347 Kay - I can't seem to recreate the problem (yet) in a test environment, whether 1.0.2 or 1.1.0. There are some (possibly irrelevant) differences between test and production, but I'll

[graylog2] Re: how to keep the log message in one field?

That is one way to do it, this works up to server 2003, server 2008 and so on is a little different, this way there is better handling of the logs. define ROOT C:\Program Files\nxlog #define ROOT C:\Program Files (x86)\nxlog Moduledir %ROOT%\modules CacheDir %ROOT%\data Pidfile

Re: [graylog2] Re: how to keep the log message in one field?

Can you explain or show what the difference is for 2008/2012 or did I misunderstand you and the config you describe below applies also to 2008/2012? Thanks, - Marco On 06/01/2015 12:41 PM, Arie wrote: That is one way to do it, this works up to server 2003, server 2008 and so on is a little

[graylog2] Re: how to keep the log message in one field?

Hello Thanks for info but my case is different (I think!) If I'm not wrong your configuration for NXLOG is to fetch live eventlogs, in my case I have a huge archive (5TB) of windows logs that have been already exported as text file, so I'm not accessing the live eventlogs on a windows