this is probably something obvious, but I’m having trouble figuring where to start. I’m not native english speaker so I kinda struggle with what I’m actually looking for is called to look up a tutorial.
I have around 15 hosts from my home network sending logs to graylog. Inside graylog I have a stream called librenms, which only receives messages filtered according to rules I set which I integrate into my LibreNMS install. So far so good.
One of the hosts (TrueNAS running on FreeBSD) sends the log messages such as this:
turbofreenas 1 2021-04-04T11:36:00.172542+01:00 turbofreenas.lan /usr/sbin/cron 21182 - - (root) CMD (PATH="/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/root/bin" midclt call cronjob.run 1 true > /dev/null 2> /dev/null)
Is there any way how I can cut off the
turbofreenas 1 2021-04-04T11:36:00.172542+01:00 turbofreenas.lan part from each message from this host before passing it to my stream? Such as via a regex like with the filters, but before it even gets to filters?
Graylog already correctly pulls the host name and timestamp from the message, so it ends up displaying the info twice such as this:
but I’d like it to look like all the other hosts (can only upload one picture so this is a link to my nextcloud:)
Hope that makes sense, thanks for any advice!