Hello all- Windows app server into Graylog 2.1.0.
Like many, we have multiline log messages. There is presently no clearly defined syntax around these messages, no end delimiter. I'm able to flow messages in using filebeat, but I can't capture multiline messages properly. I believe per a Graylog blog entry, I need a regex that matches the entire message. I don't think this is feasible with our widely-varied messages. We do have a well-defined phrase that starts every message, but I'm not sure how I would define the end of and capture the varied messages. I've tried NXLog outputting to the system input of GELF TCP. I suspect NXLog has better multiline handling, but I can't flow messages reliably using NXLog - I get shut down repeatedly by the string size limit error in nxlog.log: 2017-02-16 17:13:06 INFO connecting to 10.100.15.196:12201 2017-02-16 17:13:06 INFO reconnecting in 1 seconds 2017-02-16 17:13:06 ERROR oversized string, limit is 1048576 bytes Is there any way for me to correct this string size limit issue using NXLog CE? Any other alternatives I'm not considering? Anything I'm doing obviously wrong, or missed? Thanks in advance! --ab -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/9d1e0a3c-6451-4c06-add7-aa1d3b770270%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
