Graylog message has display hyphen "-"

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident:
i collected log from my window DC by sidecar latest version (before winlogbeat)
but in input, message only display hyphens “-” , and message extend aslo display full content of message.

how can i fix this?

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

Hello @ducna09

Thanks for the screen shot.
I have seen this before when there is an extractor or pipeline being used. This may have something to do with the shipper.

i considering graylog or sidecar, but doesn’t have any log :((


I can help you further but more information is need. If your unsure please post.

Hi my friend,
graylog version: 4.0.6+40b7be5
sidecar version: latest
window to log center: window server 2019

What does your Winlogbeat configuration look like? Or is it default?
Do you have any extractors or pipeline configuration for this input? If so how are they configured.

here is my config sidecar.

i dont have any exatroctors.


Ok I see your using Windows Forwarded events. So I assume that this windows device is the middle man for transporting logs files. If this is correct, Check the log/s for a message body. When you see "-" in a field, Elasticsearch could not identify it to place data in that field OR it was remove by other means configured in Graylog.

Example in this picture below, this shows Cut is enabled. What is does is remove data from the field, but since you stated you don’t have extractors or pipelines we probably can rule that out.

For testing purposes have you tried sending other logs instead of Forwarded events. This would give us a clearer idea what’s going on. Perhaps something like this…

 - windows
   - name: Forwarded Events
   - name: System  

If you do get data in the message field, using that config, Then we can look at the origin from where the logs are being sent. If not then we can look more into Graylog instance.

when i collect another log , for example: system log, it’s didn’t show hyphens

image (1)
but message in ForwardedEvent maybe correctly.


Ok this is weird, Windows System Events seam to work but your Forwarded Events do not.
Thanks for testing that, So this leads use to the messages/logs in Forwarded Events.

So something is funky with the Forwarded Events logs. For example, here is my lab, BUT this is not a Forwarded Events…

Next Question, The Windows Event Forwarding (WEF) reads any operational or administrative event log on a device in your organization and forwards the events you choose to a Windows Event Collector (WEC) server, in this case Its Graylog. Since I have not used this type of configuration, I would imagine that the logs are formatted in such a way that Elasticsearch cant find a “message” field " in those message. So it places "-"

EDIT: After reading over Microsoft (WEF) Have you tried using Graylog-Sidecar to pull the events you want instead of using Windows Forwarding?

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.