Filter logs Received

Graylog Central (peer support)
1

Gentlemen, what’s up?

Is there any way to filter the logs received in Graylog?

I’m asking because of my scenario, where I’m receiving logs from Vmware EXSI, and there are a lot of them every day… which quickly fills up the SRV Graylog disk…

2

Absolutly! If you have a pipeline rule wirh something in the when clause measage_type = something I dont care about, and in the then clause you have the function drop_mesaage, then those messages will be dropped and never be stored.

3

Is there a step-by-step document on how to do it?

4

Hey @badaroed

First setup you Pipeline.

https://go2docs.graylog.org/5-0/making_sense_of_your_log_data/pipelines.html
The pipeline page you need name the pipeline, attach the stream and add the rule.

Example of pipeline rule

rule “Drop Syslog Messages”
when
   has_field("level") AND
   ( to_string($message.level) == “7” OR
     lowercase(to_string($message.level)) == "debug" )
then
   drop_message();
end
5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.