Collector sidecar config syntax

Graylog Central (peer support)
,
1

Hello,

can PLEASE somebody tell me how the syntax of the WinLogBeats Input is. I have:

[{‘name’:‘Application’}] and everything is perfect.

But i need to add things like “ignore_older:72h” or “level: critical, error, warning”?

How can i put this in it?

THX!!

2

You can add custom configuration settings using snippets: http://docs.graylog.org/en/2.2/pages/collector_sidecar.html#snippets

3

Can you plese give me a example snipplet like the nxlog example?

Because if i put in:

ignore_older: 72h

a error occurs.

“Error during configuration validation… Invalid top-level key ‘ignore older’.”

I try a lot but no success.

4

Where exactly did you enter that snippet and where do you see the error message?

5

Try this format in “event name”, its working for me.

[{'ignore_older': '1h','name':'Application'},{'ignore_older': '1h','name':'System'},{'ignore_older': '1h','name':'Security'}]
6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.