I have just setup new graylog and playing with it and found my clients sending logs to graylog but its not showing in search or anywhere, if i query data in elasticsearch i can see all of my data.
-
I am using UDP 1514 input for Cisco syslog
-
Gaylog 2.4
-
ES - 5.x
-
MongoDB 3.6
[root@graylog ~]# curl ‘localhost:9200/_cat/indices?v’
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
green open graylog_1 -ZESHG13SiGV9uY5jBNqRg 4 0 22 0 151.9kb 151.9kb
close graylog_0 1BkG2DhhSNym4Y1owDtTUg
I can see all my logs in following command
[root@graylog ~]# curl -H 'Content-Type: application/json' -X GET http://localhost:9200/graylog_1/_search?pretty
{
"took" : 3,
"timed_out" : false,
"_shards" : {
"total" : 4,
"successful" : 4,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : 22,
"max_score" : 1.0,
"hits" : [
{
"_index" : "graylog_1",
"_type" : "message",
"_id" : "8b987d10-d67e-11e8-bb7b-6c3be5a99590",
"_score" : 1.0,
"_source" : {
"level" : 5,
"streams" : [
"000000000000000000000001"
],
"source" : "unknown",
"message" : "%ETHPORT-5-IF_DOWN_ADMIN_DOWN: Interface Ethernet1/1 is down (Administratively down)",
"gl2_source_input" : "5bce8baf370f98103d87fe4a",
"sequence_number" : 0,
"full_message" : "<181>: 2018 Oct 23 01:56:24 UTC: %ETHPORT-5-IF_DOWN_ADMIN_DOWN: Interface Ethernet1/1 is down (Administratively down)",
"gl2_source_node" : "cfa5b46c-2c4a-4904-9905-6e3e8a1386ed",
"facility" : "local6",
"timestamp" : "2018-10-23 01:56:24.000"
}
},
{
....
....
My Switches using following EST timestamp for logging and i have changed root_timezone = EST in graylog but still no luck, i have increase my search to 1 year but still no data.
Side note: I am running input on 1514 because graylog not allowing me to open port on 514.
also my cisco switch default send logs on 514 so i have setup iptables to REDIRECT my all logs from 514 --> 1514 ( do you think this could be the issue?)
iptables -t nat -A PREROUTING -p tcp --dport 514 -j REDIRECT --to 1514
iptables -t nat -A PREROUTING -p udp --dport 514 -j REDIRECT --to 1514
What could be wrong here?
