Graylog and mail server

If you are using filebeat going to Graylog beats input, you can modify the sidecar configuration to accept multi line messages such as the one you have shown above. There are some Elasticsearch documentation on doing that here.

Reading through your post it is very difficult to answer the question. You haven’t posted much about your environment (text formatted with </> forum tool is much better than a screen shot wherever possible.) the more information you give about your environment, what you have tried etc. the easier it is to help you to a solution. Here are tips on asking questions on the forum that also has some of the general diagnostic commands

1 Like