Search logs of a specific application

[gsmith]

Hello,

I might be able to help. As for your first question.

@altink

How to search for the logs of a specific application?

Depends on how you setup your environment for searching a particular application.

@altink

Logs of this specific application (can be a DB table, OS logs or else) are coming to Graylog from multiple sources using GELF TCP Input.

This can be done either with a unique field or tag to sort through the ingest logs. This can be done through a pipeline, extractor or from the source (log Shipper).

Example from the source. This is a remote server in my environment. I was extracting logs from a application call NextCloud using NXlog. I created a input called the same name as my application
“nextcloud”.

<Input nextcloud>
   Module       im_file
   FILE         "/mnt/nextcloud-data1/nextcloud.log"
   SavePos       TRUE
   ReadFromLast  TRUE
   PollInterval  1
   Exec  $Message = $raw_event;
</Input>

Now here is what I receive on my GL server.

I just use the field called SourceModuleName to route my messages to stream. Therefor, I do not need to create a extractor/pipeline for a new field.

As you can see I can have multiple ones. As shown on my widget below.

Depending on what type of log shipper your using this is possible.
You could use a pipeline to grab what you need and route-to-stream that way also. I guess the main subject here is you may need the correct field first.

Hope that helps
EDIT: is this the same post?

GELF TCP Input Data to specific index

I need to put all data ingested by a specific TCP Input entry into a specific index user made. For this in the UI of Graylog I created a Stream on this index. Checked “Remove matches from ‘All messages’ stream”. When create/edit the TCP Input I cannot find any place for Stream binding. I created a single stream rule “Rule always matches” for the stream created above. Question: How do I connect my specific TCP Input to this Stream (and thus index)? I want other TCP Inputs to keep storing rec…