I was having issues with the default settings for the Syslog UDP input so I switched to using the Raw/Plaintext UDP input and will set the fields I want using pipelines/rules. One issue I have is that I can’t seem to find a way to set the facility and log level fields. These values are found in the header portion of the packet so ideally I should be able to pull the values from there (RFC5424). The log level is in the message so technically I could get it from there, but that doesn’t solve the issue of getting the facility as well. Is there a variable like $header available in pipeline rules similar to $message where the facility and log level values are stored? As far as I can tell, the only variable available in pipeline rules is $message and a few sub indices like gl2_remote_ip, source, etc.
I’ve looked through the pipeline documentation and the community forums but have not been able to find a solution to this issue.
Integration with LibreNMS. Mostly Cisco devices.
Graylog - 4.1.3+9d79c05
MongoDB - v4.0.26
Elasticsearch - 7.10.2