Hello, I have some IDS logs coming into Graylog, I am trying to split the fields out to report using: let m = split("\\|", to_string($message.message)); set_field("ts", m[0]); set_field("uid", m[1]); The logs fields are separated by a tab, whats the best way of getting these into associated field…

Yep here is the the message just changes the IP for Googles: 1516195367.174058 CNDYE23uGhnLzFS9J8 8.8.8.8 23872 8.8.8.8 53 udp 54914 - r4.res.office365.com - - - - 0 NOERROR T F F F 0 r4.res.office365.com.edgekey.net 300.000000 F The split pipeline rule is as follows: rule "Extract bro_dns log fi…

Since there is no information about the field name in your message whatsoever, it’s not possible to completely automatically extract that information into message fields. But you could create a matching grok pattern if the structure of the message doesn’t change: http://docs.graylog.org/en/2.4/pa…

But I am trying to set the field name by splitting it? I think the issue is whether the split function can split “TAB” or not? Does that make sense?

[image] petegriggs: I think the issue is whether the split function can split “TAB” or not? Yes, the split() function supports tabs, or really anything you can express in a regular expression. See graylog-plugin-pipeline-processor/plugin/src/test/resources/org/graylog/plugins/pipelineprocess…

Think I am making progress but getting errors in server.log now for any new field: " error=<{“type”:“mapper_parsing_exception”,“reason”:“failed to parse”,“caused_by”:{“type”:“illegal_argument_exception”,“reason”:“Can’t parse [index] value [not_analyzed] for field [id_orig_h], expected [true] or [fa…

Try rotating the write-active index (System/Indices/Index Set/Maintenance).

Hello, Thanks for coming back Jochen. I can’t see that, running Graylog 2.4. Any pointers?

All working, the rotate fixed it. Thanks for the help.

Pipeline - Tab Split

Graylog Central (peer support)

jochen (Jochen) January 17, 2018, 1:11pm 2

Do you have examples of these messages you could share?

Multi value field

Topic		Replies	Views
Need assistance Extracting Data to new Fields Graylog Central (peer support)	3	108	July 5, 2024
Pipeline Rules and "Split" Graylog Central (peer support) pipeline-rules	5	3477	October 31, 2017
pfSense Pipeline Graylog Central (peer support)	3	1267	April 19, 2019
Pipeline - Split and Extract Graylog Central (peer support)	6	3374	February 23, 2018
Spliting a Syslog Output into fields Graylog Central (peer support)	5	1524	January 28, 2019

Pipeline - Tab Split

Related topics