Hi, On Sunday, 22 January 2017 14:06:40 UTC+1, jony wrote: > > i think it is text based but can you confirm that to me ,here's a link of > the detailed log format : https://kb.cyberoam.com/default.asp?id=1808 >
This looks relatively easy to parse with extractors or the message processing pipeline: http://docs.graylog.org/en/2.1/pages/extractors.html http://docs.graylog.org/en/2.1/pages/pipelines.html Take a look at the Key/Value extractor or the Grok extractor. > For the port number ;let's say i have 30 inputs all using tcp ,if i choose > for each one a different port number ,would that be okay ?? > Yes, that's no problem. But what exactly do you want to achieve? You don't need to start a separate input for each client (using the same protocol). Cheers, Jochen -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/0bce0190-3dda-405b-b399-ee0cbe7fb80a%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.