Graylog message has display hyphen "-"

[ducna09 (Duc Nguyen)]

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident:
i collected log from my window DC by sidecar latest version (before winlogbeat)
but in input, message only display hyphens “-” , and message extend aslo display full content of message.

how can i fix this?

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

[gsmith]

Hello @ducna09

Thanks for the screen shot.
I have seen this before when there is an extractor or pipeline being used. This may have something to do with the shipper.

[ducna09 (Duc Nguyen)]

i considering graylog or sidecar, but doesn’t have any log :((

[gsmith]

Hello,

I can help you further but more information is need. If your unsure please post.

How to Post a Question in the Community that Gets Responses

This platform is made with love for community discussions on the open source tool Graylog, it components and usage. Here’s a Graylog support-inspired template (thank you, @aaronsachs ) that’ll get responses: Description of your problem <!-- Use this section to describe the problem that you're encountering. Please include any screenshots or recordings of the problem you're running into.--> Description of steps you’ve taken to attempt to solve the issue <!-- Use this section to provide detail…

[ducna09 (Duc Nguyen)]

Hi my friend,
graylog version: 4.0.6+40b7be5
sidecar version: latest
window to log center: window server 2019

[gsmith]

What does your Winlogbeat configuration look like? Or is it default?
Do you have any extractors or pipeline configuration for this input? If so how are they configured.

[ducna09 (Duc Nguyen)]

here is my config sidecar.

i dont have any exatroctors.

[gsmith]

hello,

Ok I see your using Windows Forwarded events. So I assume that this windows device is the middle man for transporting logs files. If this is correct, Check the log/s for a message body. When you see "-" in a field, Elasticsearch could not identify it to place data in that field OR it was remove by other means configured in Graylog.

Example in this picture below, this shows Cut is enabled. What is does is remove data from the field, but since you stated you don’t have extractors or pipelines we probably can rule that out.

For testing purposes have you tried sending other logs instead of Forwarded events. This would give us a clearer idea what’s going on. Perhaps something like this…

tags:
 - windows
winlogbeat:
  event_logs:
   - name: Forwarded Events
   - name: System  

If you do get data in the message field, using that config, Then we can look at the origin from where the logs are being sent. If not then we can look more into Graylog instance.

[ducna09 (Duc Nguyen)]

@gsmith

being sent. If not then we can look more into Graylog instance.

when i collect another log , for example: system log, it’s didn’t show hyphens

.
but message in ForwardedEvent maybe correctly.

[gsmith]

Hello,

Ok this is weird, Windows System Events seam to work but your Forwarded Events do not.
Thanks for testing that, So this leads use to the messages/logs in Forwarded Events.

So something is funky with the Forwarded Events logs. For example, here is my lab, BUT this is not a Forwarded Events…

Next Question, The Windows Event Forwarding (WEF) reads any operational or administrative event log on a device in your organization and forwards the events you choose to a Windows Event Collector (WEC) server, in this case Its Graylog. Since I have not used this type of configuration, I would imagine that the logs are formatted in such a way that Elasticsearch cant find a “message” field " in those message. So it places "-"

EDIT: After reading over Microsoft (WEF) Have you tried using Graylog-Sidecar to pull the events you want instead of using Windows Forwarding?