So, I tried setting up a Syslog UDP to get the Watchguard Logs - sent in Syslog format. No good - the Input showed messages coming in - but nothing showed in search.
I found the All In One Watchguard content pack and installed it. Nice dashboards, input shows messages coming in, it has extractors - but nothing shows up in search, nor in the dashboards.
My system: Graylog 4.0.1+6a0cc0b on Red Hat, Inc. 1.8.0_275 on Linux 4.18.0-240.1.1.el8_3.x86_64
Watchguard is on the same subnet, rules applied, and, according to the input, getting to the server.
Does syslog UDP just not work?