GrayLog filter windows system logs

Hi, please help with filtering system logs.

First manually filtered
Channel:System . It works as you see

Now the same filter in stream.
image
It didnt works. Why?
If i wrote there Security it works again, but filter System not :frowning: Any ideas? Thanks

it just rerurn nothing :frowning:

I see the reason. I have no data in the stream. There is history only few hours. Even if I give there 5days option, i have only few hour in the stream. I dont know why :frowning:

@Assembler

Need to ask some questions.
After you created the stream have you tried to test the messages for that stream?

Here is an example:
I went to my Global search, this would be your example from the first picture (i.e. channel: system).
Then choose one of the messages shown from your search.

There should be a drop down arrow next to “Test against stream” and choose the stream you created for “channel: system”.

image

At the bottom of the page, you should be able to see if the stream works or not with your message.

When you create a stream, older messages will not be shown, all the newer messages arriving should be routed in that stream , that is if the stream works.

Hope that helps.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.