Hi. Graylog 6.1.6. Input configured as RAW (because Graylog in Syslog Input automatically creates not necessary hundreds, if not thousands, of fields from Fortigate logs). In Search mode I see 3 fields - message, source and timestamp. The message field contains, of course, the entire original log. …

The awareness that something might be wrong with the message field kept bothering me all night, so first thing in the morning :slight_smile: — as a test — I set a condition in the pipeline to check whether such a field exists. It turned out that the condition was not met because the rest of the pip…

Problem in pipeline with Fortigate logs

Graylog Central (peer support)

Joel_Duffield (Joel Duffield) February 20, 2025, 7:47pm 2

Are there any errors in server.log or the OpenSearch logs. Most often when messages simply disappear it is because they cannot be stored properly into OpenSearch for some reason.

Also the debug function may help you Messages do not get through a pipeline - How to debug? - #3 by lukas.pavljuk

Topic		Replies	Views
Odd Pipeline/Stream Behavior Graylog Central (peer support)	10	404	January 19, 2024
Fortigate field mapping problem Graylog Central (peer support)	4	1491	March 25, 2020
Pipeline Rule doesn't see extracted fields but only a few $message properties like $message.message and $message.level Graylog Central (peer support) pipeline-rules , debuggingpl	4	2322	November 29, 2017
Extractor fields not appearing when simulating pipeline Graylog Central (peer support) pipeline-rules , debuggingpl	8	2134	May 12, 2020
Messages for some streams dissapear when I have a multiple stages in pipeline Graylog Central (peer support) basic-configuration	12	866	January 25, 2022

Problem in pipeline with Fortigate logs

Related topics