Hi all, I’m trying to parse some logs. I first wrote a BASH script to format the logs in JSON and export to graylog. Graylog is receiving the full messages. I put a JSON extractor and the preview shows all the fields but when I search for message, a few fields are missing.
OK. Maybe my json format is wrong. So I decide to rewrite the script to space separate the data. I changed the input type to raw data. I used the split and index. The preview again shows the messages and data extracting correctly but the messages again are missing half the fields.
What gives? What am I doing wrong? How do I find out what is happening?