Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question. Don’t forget to select tags to help index your topic! 1. Describe your incident: i collected log from my window DC by sidecar latest version (…

Hello @ducna09 Thanks for the screen shot. I have seen this before when there is an extractor or pipeline being used. This may have something to do with the shipper.

i considering graylog or sidecar, but doesn’t have any log :((

Hello, I can help you further but more information is need. If your unsure please post. [image] How to Post a Question in the Community that Gets Responses New to Graylog Community? READ-ME FIRST Guides This platform is made with love for community discussion…

Hi my friend, graylog version: 4.0.6+40b7be5 sidecar version: latest window to log center: window server 2019

What does your Winlogbeat configuration look like? Or is it default? Do you have any extractors or pipeline configuration for this input? If so how are they configured.

here is my config sidecar. [image] i dont have any exatroctors.

hello, Ok I see your using Windows Forwarded events. So I assume that this windows device is the middle man for transporting logs files. If this is correct, Check the log/s for a message body. When you see "-" in a field, Elasticsearch could not identify it to place data in that field OR it …

[image] gsmith: being sent. If not then we can look more into Graylog instance. when i collect another log , for example: system log, it’s didn’t show hyphens [image (1)] [image]. but message in ForwardedEvent maybe correctly. [photo_2022-10-31_11-43-19]

Hello, Ok this is weird, Windows System Events seam to work but your Forwarded Events do not. Thanks for testing that, So this leads use to the messages/logs in Forwarded Events. So something is funky with the Forwarded Events logs. For example, here is my lab, BUT this is not a Forwarded Event…

Graylog message has display hyphen "-"

Graylog Central (peer support)

gsmith (GSmith) October 25, 2022, 9:06pm 4

Hello,

I can help you further but more information is need. If your unsure please post.

Topic		Replies	Views
Not see any messages in the Graylog console from winlogbeat sidecar Graylog Central (peer support) sidecar , winlogbeat	4	283	April 24, 2024
Windows events to graylog server Graylog Central (peer support) sidecar , filebeat-windows , winlogbeat	2	4915	December 13, 2018
Help with extractors Graylog Central (peer support) sidecar , nxlog , winlogbeat , nodatanx	12	3020	January 25, 2019
Winlogbeat sidecar message not incoming Graylog Central (peer support) sidecar , winlogbeat	5	759	July 21, 2023
Instead of Single log message it displays multiple messages Graylog Central (peer support)	4	2890	January 23, 2019

Graylog message has display hyphen "-"

Related topics