Pensando / switch logging multiple lines

New to Graylog Community? READ-ME FIRST Guides
1

Hello,
I’m using the free version of Graylog and running into an issue. Pensando is sending its output to Graylog, but often there are 3 log entries combined into a single message.
I’ve tried several things (with pipelines), but I can’t manage to split them correctly. As a result, I also can’t apply extractors effectively.

Does anyone have an idea how I can fix this?
Here’s an example of what the message looks like:

switch1 switch1[1410]: 2025-07-16T05:55:19Z,flow_delete,allow,c574ab42-ab87-462f-8302-99d2a05babfd,10.32.12.20,49635,10.32.14.117,9080,6,1002,00000000-0000-0000-0000-000000000000,15,3141,11,5453,3314,DSS,DL.10.15.1020,VN48LYG01C,a852.d4f5.fa80,2,v3,false,from-uplink,NA,tcp_rst,tst-domain,1,0,0
2025-07-16T05:55:19Z,flow_delete,allow,c574ab42-ab87-462f-8302-99d2a05babfd,10.32.14.16,20830,10.32.14.116,2380,6,3146110,00000000-0000-0000-0000-000000000000,1,82,1,68,3314,DSS,DL.10.15.1020,VN48LYG01C,a852.d4f5.fa80,2,v3,false,from-uplink,NA,tcp_rst,tst-domain,1,0,0
2025-07-16T05:55:19Z,flow_delete,allow,c574ab42-ab87-462f-8302-99d2a05babfd,10.32.14.16,20829,10.32.14.116,2380,6,2622417,00000000-0000-0000-0000-000000000000,1,82,1,68,3314,DSS,DL.10.15.1020,VN48LYG01C,a852.d4f5.fa80,2,v3,false,from-uplink,NA,tcp_rst,tst-domain,1,0,0

2

Hello @nieuwenampsen,

Inputs on Graylog utilise a delimiter in order to split messages, new line for example. In what format is your switch sending logs and can that be altered at the source?

You could try selecting the “Null frame delimiter?” option within the input configuration and seeing is that makes a difference.