# OSSEC with Graylog

**URL:** <https://community.graylog.org/t/ossec-with-graylog/3132>\
**Category:** Graylog Add-ons\
**Created:** [November 10, 2017, 6:20pm UTC](https://community.graylog.org/t/ossec-with-graylog/3132 "2017-11-10T18:20:07Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mudassir](https://avatars.discourse-cdn.com/v4/letter/m/4da419/32.png) [@mudassir](https://community.graylog.org/u/mudassir)\
**Post date:** [November 10, 2017, 6:20pm UTC](https://community.graylog.org/t/ossec-with-graylog/3132/1 "2017-11-10T18:20:07Z")

</div>

Hi Everybody,

i tried to configure OSSEC with Graylog and its working but the problem is Graylog cannt process those logs.  
logs are unstructured and cannot be indexed.

Anybody faces same issue?

Kindly leave your valuable suggestions…

Thank you.

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [November 11, 2017, 8:59am UTC](https://community.graylog.org/t/ossec-with-graylog/3132/2 "2017-11-11T08:59:08Z")

</div>

What type of logs are you referring to?  
Have you seen the [CEF plugin](https://marketplace.graylog.org/addons/b2c55194-a76e-4fd7-89fd-5421188bf33f) in the [Graylog Marketplace](https://marketplace.graylog.org/)?

---

<div class="post-metadata">

**Author:** ![mudassir](https://avatars.discourse-cdn.com/v4/letter/m/4da419/32.png) [@mudassir](https://community.graylog.org/u/mudassir)\
**Post date:** [November 11, 2017, 9:04am UTC](https://community.graylog.org/t/ossec-with-graylog/3132/3 "2017-11-11T09:04:09Z")

</div>

i am using Graylog Beta 2.4 version which is being shipped with CEF plugin by default, i check the plugin directory also and CEF plugin is there. I started input in graylog with CEF format and then entered the same port and graylog IP in OSSEC Server. I can see the logs in graylog but those are unstructured and i can see in graylog metrics as failures about those messages.

Thank you

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [November 11, 2017, 3:04pm UTC](https://community.graylog.org/t/ossec-with-graylog/3132/4 "2017-11-11T15:04:37Z")

</div>

Maybe you could add some example messages to this GitHub issue so we can try to reproduce the problem:

> <https://github.com/Graylog2/graylog-plugin-cef/issues/23>

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [November 25, 2017, 3:04pm UTC](https://community.graylog.org/t/ossec-with-graylog/3132/5 "2017-11-25T15:04:57Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.