Hello friends, I come from here asking for help from experts. I have two firewalls with “syslog/udp” configured. Sophos19 and FortNet7.2 I realized that when FortNet received the logs, it was not necessary to configure extractors to get the fields all separated in an organized way. However, Soph…

Hello, @s0p4L1N Grateful! With a little modification I was able to resolve both Sohpos syslog issues: rule "Firewall Syslog Parser" when has_field("message") and contains(to_string($message.message),"device_name=\"SFW\"") and from_input(id:"64d658ba5c1b4b3b03d8741f") == true then set_fiel…

Syslog format does not follow recommendation

Graylog Central (peer support)

s0p4L1N (S0p4L1N) September 8, 2023, 12:33pm 17

@isotecviac2022 check this post: Rename Multiple Fields Using Pipeline Rule

1 Like

Topic		Replies	Views
GROK Extractor question Graylog Add-ons pipeline-rules	15	9060	February 20, 2017
Graylog 2.2 update from 2.1: Error processing message RawMessage Graylog Central (peer support)	24	7163	February 24, 2018
Extra entrys in graylog - Graylog Central (peer support)	32	3842	June 7, 2017
Fortigate Messages Coming in 4 hours behind starting after update Graylog Central (peer support)	16	4944	June 26, 2017
How to correct syslog input that is missing timezone data? Graylog Central (peer support) pipeline-rules	3	1708	June 21, 2020

Syslog format does not follow recommendation

Related topics