Hello people! I newbie in graylog and I want understand how right parse syslog messages from many services. Let's say I have three services. Each from one use different message format. For example: service1: "service1: srcip dstip" service2: "service2: dstip bytes clientid" service3: "service3: srcip userid bytes etc" Those, on the first field I can define the type of service, but further each service has different fields. How to handle it properly? Build separete "inputs" on different ports and extractors or one input and one difficult grok pattern?
-- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/f334f49b-34e9-4126-9d42-27bb02fa0fee%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
