Hi everyone, I am hoping someone can help me troubleshoot an issue with our Graylog pipeline rule and grok extractor. We recently noticed our firewall logs capturing repeated outbound connections where users were attempting to fetch various roblox scripts, specifically targeting the URL on our network. The main issue is that our pipeline is failing to parse the full URI path whenever it encounters multiple hyphens, causing the messages to fail extraction and bypass our alert streams. In addition to that, the unparsed messages are skewing our dashboard metrics and creating an unexpected backlog in the journal. Has anyone run into a similar parsing problem with hyphenated URI strings in Graylog, and what would be the cleanest way to adapt the extractor so these requests are properly categorized without bogging down processing?
Hello,
If you want some help you should provide an example of a log and the pipeline rule