Hi
I have the problem that right after adding a grok extractor to an input the
system immediately stopps sending messages to elasticsearch (out = 0). Does
somebody had the same experience?
My pattern looks like
"client\s%{IPV4:src_ip}#%{BASE10NUM:src_port}\s\(([a-zA-Z0-9.\-_]*)+\):\squery:\s%{NOTSPACE:dns_name}\sIN\s%{WORD:dns_type}\s%{NOTSPACE:dns_flags}\s\(%{IPV4:dns_server}\)"
and is for bind messages.
I have the latest 1.2.1 version installed. Graylog-server, -web and
elasticsearch are on different machines.
Thank you and kind regards
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/88f8a45e-8e14-4ec8-945a-4a47f4cad399%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
