RAW Input with "Null frame delimiter" and "newline delimiter"

Graylog Central (peer support)
1

Hi,

I have multiple Firewalls (Manufactors) with individual log format. So I would like to Import this with one RAW Input in graylog.

The Problem I have now is that one Firewall uses a newline delimiter and the other a null frame delimiter. Is it possible to support both on one input?

Null frame delimiter?(optional)
Use null byte as frame delimiter? Otherwise newline delimiter is used.

Depending on the quoted setting I get the Logs of Firewall A or B.

Kind regards
Julian

2

No, you’ll have to create two separate inputs for this.

1 Like
3

I came for the same thing. A mix of null-delimiter and newline-delimiter framing.
As a bonus I have one device that does length-prefixed framing :frowning: and syslog input fails on it.