Handling syslog messages that are split by the source application

Graylog Central (peer support)
2

I haven’t come up with a solution, but some question I have as I was thinking about it:

  1. Does any of your data ever contain the “…” sequence, or is it only in the case of a truncated message?
  2. Are the truncated messages always sequential, or could there be an unrelated message slipped between them?
  3. can you change the max length of the message on the application, or failing that, can you change the delimiter to something more unique that would not appear in a message?
  4. Have you investigates slookup? GrayLog Stream Lookup (SLookup) Pipeline Processor function

I was thinking some sort of intermediate application to handle these and ship them to Graylog, but maybe there’s a way that Graylog can coalesce two messages together. I’d be interested to hear the solution you come up with, I hope you’ll post it.