Graylog and mail server

Hello

What I understand is,

  • You created a mount point on Graylog Server for you mail logs and the mail server is a remote device.
  • Your using FileBeat for Local logs and from this mount point from your mail server

You have a couple choices.
1.First, as @tmacgbay suggested a multiline on FileBeat here
2.Second, remove the mount point on Graylog server from the mail server and install a log shipper on the mail server to send those logs to a Raw/Plaintext INPUT.
3.Third, You can install two different Log shippers on Graylog server and point them to TWO different inputs, Probably not advisable but it can be done.

1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.