Correlating logs with Graylog 3.0

Graylog Central (peer support)
1

Hello,
I am looking for a way to do some log correlation.
For exemple, I would like to calculate the duration of a ssh session when I receive a log "pam_unix (…) closed)
I have tried writing a pipeline rule to add the duration field in this kind of log but I cannot find a way to “query” the same index in order to find the start ssh session log.
I have seen the slookup plugin for graylog 2 but I am using Graylog 3.0.

Thank you =)

2

not possible to correlation between messages in graylog.
You can use alerts, but it’s not really the same.

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.