I’ve set via plugin " Logging Alert Plugin for Graylog" a new alert, I need generate a new event if my alert has match with the stream. This way (I think) is working fine because the event is generate into Graylog but in “/var/log/graylog-server/server.log”. I can’t see this event on Graylog search. The event is into “server.log”, a put a sample:
2019-05-01T15:57:43.075+02:00 INFO [LoggingAlert] type: alert | id: 5cc9a5d5da55db4e328d460c | severity: high | app: graylog | subject: Root logon | body: Stream received messages matching message:“root” (Current grace time: 0 minutes) | src: | src_category: | dest: | dest_category:
Why I can’t see the event in the “search”??? How I can do it that, I can see the event generated vi alert in “Search”???
So, Also I’ve seen another option is use other plugin as " Internal Logs Input Plugin for Graylog". I found this solution but I created the input but I can’t see the events into the “Search”. I’m confuse because in the input I can see the metrics has messages (a lot of events)…but I go to “search” and I don’t see nothing. Sorry but its is difficult for me. I’m very frustrated.
Do you have any idea about this, could you help me please???
I mean use rsyslog, my rsyslog cofig has, such as:
I think that can be works but I’m testing and its is not running. I can’t work with this way yet…impossible.
Please, do you help me for any solution??? I want see the event generate for new alert!!!