I’m trying to refine the incoming syslogs from 30 Meraki’s. Key=Value works for most of the message, but I am trying to convert some data into columns where the value changes based on which Meraki is sending the data.
<134>1 1634220216.200448655 MERAKI1 flows src=0.0.0.0 dst=188.8.131.52 protocol=udp sport=420 dport=420 pattern: allow all
For the above, I can K=V the SRC, DST, protocol, sport, and dport. But I can’t seem to find a way to turn “MERAKI1”, “flows”, and “pattern: allow all” into fields that would contain these values (all of which can change).
One solution might be to use a pipeline rule to convert all spaces into commas and then turn each csv into a generic column, but I have no idea how to do most of that.
Ref: using Graylog 4.2/ElasticSearch 7.10.2 on latest Ubuntu, Input is RAW UDP.