Drop few words from Logs

Graylog Central (peer support)
22 
rule "function remove Fortigate Fields"
when
    has_field("devname") &&
    has_field("vd")
then
    remove_field("vd");
    debug("**** Found both fields - DEVNAME and VD ---  attempted removal of VD");
end

You can then tail your Graylog server logs to see if the words from the debug function show up.

23

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.