Hello, I’m setting up new logs management for an application with Graylog. Logs are sent to Graylog using an UdpAppender on the application log4net.config file. A specific input was created te receive these messages, and there are well received. Now, I would like to add an extractor to extract i…

I found the root cause and it was my log4net configuration… Encoding has to be set to avoid these extra chars. Previous config: <appender name="MyUDPAppender" type="log4net.Appender.UdpAppender"> <remoteAddress value="000.000.000.000" /> <remotePort value="12345" /> <layo…

Hello @MazeOfFate [image] MazeOfFate: Now, I would like to add an extractor to extract information from a message but a simple regex doesn’t match. Message example: I seen something similar to this before. [image] Working with Pipelines Graylog Central (peer support) …

If this is handled in the pipeline you can use the split() function as I did in the referenced post and use the | as the marker for splitting…

Hey, Are you referring to something like this? let m = split("\\|", to_string($message.message)); set_field("info", m[0]); set_field("hosts", m[1]); I’m working in my lab, haven’t done this yet so I figured i give it a go.

@tmacgbay Think I got it :smiley: rule "fields" when true then let m = split("\\|", to_string($message.message)); set_field("datetime", m[0]); set_field("info", m[1]); set_field("ops", m[2]); set_field("hosts", m[3]); set_field("mgms", m[4]); end Results: [image]

Hello, Thanks for your answers. But my issue is not really on how to retreive values by spliting them but more why there is unexpected chars between letters of the message. I’m using a ’ Raw/Plaintext UDP’ input, I tried with a ‘Syslog UDP’ input, same issue. The only one workaround I found, bas…

Message format issue

Graylog Central (peer support)

tmacgbay (Tmacgbay) August 25, 2022, 1:24pm 8

Ha! That was going to be my suggestion just as I was reading through this completely - I had an issue a while back with UTF8 encoding…

Glad you found it!

Good work by @gsmith coming up with an excellent and unaskedfor pipeline rule solution too!!

Mark your post as a solution for future UTF8 searchers!!

Topic		Replies	Views
Regex Matching in Pipeline or Extractor Graylog Central (peer support)	17	3361	January 17, 2023
Difficulties to apply extractors using regex Graylog Central (peer support) key_value	46	3002	April 8, 2022
Unifi syslog, stream, pipline, regex Graylog Central (peer support) pipeline-rules , regex-special-charac	10	2403	December 28, 2022
Extractor missing fields. How can I troubleshoot? Graylog Central (peer support)	13	3756	December 13, 2017
Two questions: delay in applying configuration changes & difficulty extracting key=value pairs Graylog Central (peer support) basic-configuration	20	1354	February 17, 2022

Message format issue

Related topics