Graylog not parsing hostname in log messages

[gsmith]

Hello,

@tuaris

The message does indeed apear to be multi-line as suspected in the referenced post:

I did find this post here but unfortunately I don’t see it resolved.

The screenshots look like firewall/switch messages? So you probably cant use a log shipper. If you could, FileBeat would be able to correct this issue with multi-line messages.

If this is correct and these messages/logs are from Firewall/Switch then a pipeline would be your best bet for correcting this.

Here are some links I found they might help.

Graylog pipeline regex multi match

Hello, From what I understand from several places (e.g. there: Can a pipeline rule to match the same pattern multiple times?), if a group in my regex happens several times in the original string, I should be able to get several matches. However, I’m not, so there’s something I must misunderstand. For example, here’s a very basic example of a rule, input, and what I get in the pipeline simulator: rule: when has_field("test") then let result = regex("([0-9])", to_string($message.message));…

https://graylog.zammad.com/help/en-us/15-pipeline-rule-samples

FileBeat

• Manage multiline messages | Filebeat Reference [8.11] | Elastic