Correlating logs with Graylog 3.0

I am looking for a way to do some log correlation.
For exemple, I would like to calculate the duration of a ssh session when I receive a log "pam_unix (…) closed)
I have tried writing a pipeline rule to add the duration field in this kind of log but I cannot find a way to “query” the same index in order to find the start ssh session log.
I have seen the slookup plugin for graylog 2 but I am using Graylog 3.0.

Thank you =)

not possible to correlation between messages in graylog.
You can use alerts, but it’s not really the same.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.