To get all the data from a single log in a single Graylog message

Hi everyOne,

I have a question, is there a possibility to get all the data from a single log in a single Graylog message? . apart from being able to export them with the option of export to csv? Its possible ?

Regards,
Peter.

Hi Everyone,

Can you help me with my question, please ?

Regards,
Peter.

Why is CSV export problem for you? What kind of output format do you need, plese post example:
Timestamp Message?

You can still use Rest API to export data as json, and process it with some script or json parser.

Hi Shoothub,
First of all thanks for answering and now, it is not that it is a problem but I would like to have the whole log and not have to export it. Can Graylog collect the whole in 1 single message?

I would like for example to collect the entire log sent by a tomcat through rsyslog and for graylog to collect the entire log in 1 single message. its possible ?
regards,
Peter,

Sorry I don’t undestand what to what to archive and why…

  1. Do you want to ingest (import) logs from e.g apache already in file and send it to graylog
  2. Or you want to export data from graylog to another system?

Yes, exactly . I want to ingest (import) logs from, for example, apache that is already in the file (apache.log) and send it to graylog, and that graylog collects it in its entirety, in the ‘All Messages’ section, in 1 single message. not the log split into message, I would like to collect the entire log without having to use the export (csv).

graylog receives messages from the apache log in parts. I would like the entire log to arrive and not in parts.

You can of course ingest log file using lot of ingest aplication like rsyslog, syslog-ng, filebeat or mxlog. But by default message field is limited to 32KB, so it’s not a good idea try to put a lot of data into one message I think.

hi ,
if i install Logstash on the graylog server, in order to get the entire log. it could be done ?

many many thanks,
Peter.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.