Syslog TCP input normalization

[gsmith]

Hello,

@dio99

i want to use my own rules to normalize the logs that are normalized on the syslog tcp input, by default it parse it and set all fields to string.

I see, if you referring to the default fields such as timestamp, message, etc… then you would need to create a new index template and attach it to new index set.

Here is a couple ideas depending on this environment. It is possible to change specific fields type from string to integer (or float). this can be done using the curl command in Elasticsearch.

Examples:

First you would get the mapping

curl -X GET "localhost:9200/graylog_1600/_mapping?pretty"

• Update mapping API | Elasticsearch Guide [8.11] | Elastic

Then adjust those fields as needed.

curl -X PUT "localhost:9200/graylog_1600/_mapping?pretty" -H 'Content-Type: application/json' -d'
{
  "properties": {
    "email": {
      "type": "integer "
    }
  }
}
'

Or use a Pipeline something like this.

• Pipeline - Create field with value from another field - #2 by tmacgbay

If your going the pipeline route @tmacgbay would know better then I would.

Hope that helps