Hello. This is my first time posting in this community. First off, thank you for taking the time to read this post. I have been using Graylog for a little over a year and it is an absolutely wonderful product. I have an issue with messages not being saved in Graylog.
I am sending messages from haproxy via rsyslog to graylog over UDP. These messages are all in JSON format. I am using a JSON extractor to extract the messages. I noticed some time ago that a few specific website logs were not making it to Graylog, so I began to investigate. I started by doing a packet capture on the Graylog Server. I navigated to the website, and immediately I was able to see the message in JSON from the TCP dump. So the message is making it to the Graylog Server.
I guess my question is how can the message make it to Graylog, but not be saved? I originally thought the message was just not extracting properly, but it turns out the message is not being saved at all by Graylog. Does anyone have any thoughts or suggestions? Thanks again in advance.