Message format issue

[gsmith]

Hello @MazeOfFate

@MazeOfFate

Now, I would like to add an extractor to extract information from a message but a simple regex doesn’t match.
Message example:

I seen something similar to this before.

Working with Pipelines

here is an scenario in my environment: Logs from Palo Alto come in as type SYSTEM or TRAFFIC (there are more but lets stick with these two). I want to break out the fields in the two types of logs but they have different fields. To apply the relevant rule to the fields, first I have a rule that pulls out the type and creates a log_type field for it so it would be either log_type:SYSTEM or log_type:TRAFFIC. This is placed in Stage 0 that is set up to move to Stage 1 if any rules in Stage 0 a…

@MazeOfFate

Do you think that this behaviour is coming from the application log4net.config file or from Graylog itself?

Graylog only interrupt what logs has been sent, to the type of input being used, have you tried different inputs?

@MazeOfFate

Do you already had this kind of issue and how did you solve it?

Correct me if I’m wrong , are you trying to separate the message into different fields?

2022-08-23 11:57:17,925 | INFO | Operation | MY-HOST-NAME-001 | Message Text

Or are you trying to just search for messages?

EDIT: Here is an example of regex grabbing the first pipe, this is a demo.

^.*?\|(.*?)\|.*$

Results: