ferdagon
February 26, 2024, 8:50am
1
1. Describe your incident:
2. Describe your environment:
OS Information: Rocky 9.1 with Kubernetes Cluster and Graylog 4.3.15
Package Version: Graylog 4.3.15
Service logs, configurations, and environment variables:
3. What steps have you already taken to try and solve the problem?
Idle writer timeout (optional) to 0
4. How can the community help?
Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]
What are you using to ship the logs to this input?
ferdagon
February 26, 2024, 1:03pm
3
Hello!
Nxlog → Haproxy → metalLB → Graylog
Thanks greetings!
@ferdagon
What does your NXlog configuration look like and how are the GELF inputs configured?
ferdagon
February 27, 2024, 9:03am
5
NXLOG
Module im_file
File "/var/azure/eventhub/eventhub.log"
Exec if $raw_event =~ /^$/ drop();
Exec $agentName = "eventhubagent";
if $raw_event =~ /- - (.*)/
{
$short_message= $1;
}
Module om_ssl
Host destination
Port 443
CAFile /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
OutputType GELF_TCP
Every 30 sec
First 2010-12-17 00:19:06
Exec reconnect();
HAPROXY
acl host_azureeventhub443 hdr(host) -i url:443
backend azureeventhub
METALLB
k get services -n logserver | grep 15390
GRAYLOG
Good morning @ferdagon
If you were to attempt to use raw input as opposed to GELF as you then able to ingest logs?
