How to modify type of SEVERITY field in CEF format

Graylog Central (peer support)
1

Hi,

Sorry for my bad english !

Here is the version of different packages what I use :

elasticsearch-6.8.2-1.noarch            
graylog-server-3.1.1-1.noarch           
graylog-3.1-repository-1-1.noarch       
mongodb-org-tools-3.6.14-1.el6.x86_64   
mongodb-org-3.6.14-1.el6.x86_64         
mongodb-org-shell-3.6.14-1.el6.x86_64   
mongodb-org-server-3.6.14-1.el6.x86_64  
mongodb-org-mongos-3.6.14-1.el6.x86_64

I use graylog to collect log from OSSEC SERVER in CEF format

When I want to search severity field with arithemtics comparaison such as “<, <=, >=,>”.
I note the wrong result, exemple : “source: AND severity:<7” , results are severity 5,7,10 …

After find type of severity field in ES, I noted is “keyworld” and not “long”

My question is, how can I modify type of this field for current index and new index ?
Otherwise, is it possible to use Pipeline or GROK or something else to modify in realtime the type of this field ?

Regards,

KirM

2

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.