i have a problem in source field value for certain clients appearing as a month name instead of its IP/hostname. the common issue is that these clients are for vendor Huawei & they are routers of series NE40E [image]

[image] mbahaa: the common issue is that these clients are for vendor Huawei & they are routers of series NE40E They might not send well-formed syslog messages which is parsed incorrectly by Graylog’s syslog inputs. Try using custom extractors (or pipeline rules) for these devices.

Can you support with documentation link to help with this? Another question please can extractors support to force source field to list the device hostname exactly?

http://docs.graylog.org/en/2.3/pages/extractors.html http://docs.graylog.org/en/2.3/pages/pipelines/rules.html http://docs.graylog.org/en/2.3/pages/pipelines/functions.html

Source client appears as a month name instead of its IP/hostname

Graylog Central (peer support)

jochen (Jochen) December 6, 2017, 12:07pm 4

http://docs.graylog.org/en/2.3/pages/extractors.html
http://docs.graylog.org/en/2.3/pages/pipelines/rules.html
http://docs.graylog.org/en/2.3/pages/pipelines/functions.html

Syslog input without source ip

Topic		Replies	Views
Syslog input without source ip Graylog Central (peer support)	3	5805	January 19, 2018
Making source field show hostname instead of ip-address Graylog Central (peer support) pipeline-rules	4	12485	November 27, 2018
Source name in the Cisco Firepower Syslog Graylog Central (peer support) pipeline-rules	11	4670	November 27, 2018
How delete the colon from source(hostname) Graylog Central (peer support)	2	1783	August 8, 2017
Parsing syslog messages Graylog Central (peer support)	6	4673	October 4, 2017

Source client appears as a month name instead of its IP/hostname

Related topics