I am looking for a way to do some log correlation.
For exemple, I would like to calculate the duration of a ssh session when I receive a log "pam_unix (…) closed)
I have tried writing a pipeline rule to add the duration field in this kind of log but I cannot find a way to “query” the same index in order to find the start ssh session log.
I have seen the slookup plugin for graylog 2 but I am using Graylog 3.0.
Thank you =)