Hello Graylog Community!
I’m just starting my learning curve as far as Graylog is concerned. I have, however used google as well as the search function within this forum so I’m fairly confident my question hasn’t been asked hundreds of times before. If I’m wrong I’d still appreciate a pointer into the right direction
I set up my first data-adapter/lookup-table to translate IP addresses to hostnames via reverse DNS and it works great.
Now I would like to have the Port Descriptions of my Cisco Switches inside the logs. I parsed the Cisco Config files and created a CSV file as follows:
hostname,ip_address,switch_port,port_description heS01,172.30.254.1,GigabitEthernet1/0/1,PGZ WKS 34a heS01,172.30.254.1,GigabitEthernet1/0/2,PGZ WKS 44a [...] heS02,172.30.254.2,GigabitEthernet1/0/1,PGZ WKS 34b heS02,172.30.254.2,GigabitEthernet1/0/2,PGZ WKS 44b [...]
The problem I see is that with the CSV data adapter I have only one key field, but I would need a lookup based on two keys hostname+switch_port or ip_address+switch_port.
I could setup a csv file and data adapter per switch, but this would require manual work every time a switch is added or removed.
Is there a possibility to use such a composed key “hostname+switch_port” or is lookup table not the way to go? If not, would you suggest an alternative approach?
thanks in advance,