So I’ve added a “php_fatal_error” extractor which will look for all messages which match “PHP Fatal error: (.+)”. Nice!
I can use search for “php_fatal_error:*” and I see it correctly extracts the values into:
php_fatal_error Uncaught exception ABC happened php_fatal_error Uncaught exception XYZ happened
Now, how do I get graylog to do something really useful with it?
Say, I’d like to see top 10 errors for php_fatal_error in the last hour:
count link to events message 127 --- Uncaught exception ABC happened 112 --- Uncaught exception XYZ happened 95 --- Fatal X in /path/to/file.php:18
Is it possible with graylog?