Can I apply different grok pattern in single input?

Graylog Central (peer support)
1

Hi all, I am new to graylog, and I am trying to using graylog store and do some anylize in syslog.

I had setting up a input (a syslog), and setting my firewall send session and nat logs to graylog server.

Then I add an grok extractor for nat log in this input, it works fine, I can searching search tab using my own pattern.

But how can I adding a new grok extractor in session log? while both session and nat log are in same input.

I tried streams, and made two different streams to seperate session and nat logs, is this a good idea to apply grok pattern in streams, instead in inputs?

Thanks!

2

Hello @baalkchina,

You are on the right track by considering using streams. Apply a pipeline to each stream and parse out messages with rules as opposed to extractors. You will find there is much more flexibility within pipelines and rules.