My 6 ESXi hypervisors floods graylog with 2M messages a day, majority of logs are DEBUG (~90%), so I want to drop DEBUG logs entirely.
I have separate input just for ESXi: syslog on 1514/tcp.
I created “ESXi” stream which takes logs just from that input: Field gl2_source_input must match exactly 5XXXXXXXXXXX
to_string($message.level) == “7”
Pipeline connections: stream “ESXi”
Stage0: dropOnDebug (At least one of the rules on this stage matches the message)
I still get DEBUG logs.