RAW Input with "Null frame delimiter" and "newline delimiter"

(Julian M) #1


I have multiple Firewalls (Manufactors) with individual log format. So I would like to Import this with one RAW Input in graylog.

The Problem I have now is that one Firewall uses a newline delimiter and the other a null frame delimiter. Is it possible to support both on one input?

Null frame delimiter?(optional)
Use null byte as frame delimiter? Otherwise newline delimiter is used.

Depending on the quoted setting I get the Logs of Firewall A or B.

Kind regards

(Jochen) #2

No, you’ll have to create two separate inputs for this.