I have a Graylog install running. Most of it works fine.
I created a new input for a Syslog UDP data source. It IS recieveing data, both as seen by tcpdump and in the inputs interface.
However, none of the data seems to be searchable.
So I can’t create extractors because there are no messages to base them on. I can’t do it by message ID either, since I can’t find a message to get the ID from.
My input, “cowrie-hpot” doesn’t appear in Sources, and the overridden “source” field doesn’t show up as a source in Search.
My OTHER inputs create data sources that get indexed just fine. I have syslog TCP and UDP coming in, as well as a GELF source from various firewalls, servers, and proxies. So its not that something wrong with the entire GL installation.
What are some things that could be preventing that one input not creating usable data? Where is it going? How do I fix it?
Removing the input and creating a new one didn’t help.