Does anyone know how to create a rule that distinguishes between “,vmx1,” and ',vmx1.703," (these are interface name and interface name + vlan number)?
Why “then” clause does not allow nested “when” conditions?
Is there a documentation of what I can and cannot do when writing rule conditions?
There is a free training course Log Ingestion
The idea of pipeline rules is that you run multiple rules over multiple stages rather than allowing if statements in the single rule.
A combination of regex and NOT in your when statement should allow you to split those up.
I need a finite state machine algorithm to implement. How may I do it with these videos?
Is it possible to create custom grok patterns in GrayLog? AI says yes, but it doesn’t work the way it describes.
unless you post AI’s answer, nobody can tell what’s wrong with it.
Here is a link to our docs: Functions Descriptions
GROK1 claims that if I want to create this pattern:
INTERFACE [A-Za-z0-9]+(.[0-9]+)?
I need to create a file /etc/graylog/server/grok-patterns/custom with the line above, make it owned by graylog with access mask 644. Then edit the /etc/graylog/server/server.conf file and add the line “grok_patterns_path = /etc/graylog/server/grok-patterns/”. Restart the graylog-server service and now I may use the INTERFACE pattern to parse messages.
That does not work.
No, that does not work. We do not state anything like that in our docs, by the way. Please spend some more time reading the docs and familiarise yourself with it. It seems that in the long run, you might save time by doing so instead of trying to chase down what AI has wrong.
To create your pattern, go into the User Interface, System->Grok Patterns->press the “Create pattern” button.
Can you please clarify/give more info on your use case? What are you trying to achieve?
I want to create a log parser that analyses incoming strings and parses them character by character making on the fly decision what every character is and part of what value it might be.
Trying not to multiply threads: is it possible to apply a pipeline rule to all unprocessed messages in the index?
OK, I know the answer myself: with standard GrayLog functionality – NO.
