Hi, please read the documentation again: http://docs.graylog.org/en/2.1/pages/geolocation.html#configure-the-message-processor
I've already quoted the relevant parts in my previous post. You have to extract the information into separate fields. Currently everything is in the "message" field. Cheers, Jochen On Tuesday, 7 February 2017 13:59:54 UTC+1, CTuser wrote: > > Here is some log for example: > > --------------------------------------- > message > 192.168.99.1 date=2017-02-07 time=14:56:43 devname=PrimaryFGT > devid=FG100D3G16814848 logid=0000000013 type=traffic subtype=forward > level=notice vd=root srcip=27.214.37.81 srcport=29770 srcintf="wan1" > dstip=199.203.140.150 dstport=23 dstintf="wan1" sessionid=968745459 proto=6 > action=deny policyid=0 dstcountry="Israel" srccountry="China" trandisp=noop > service="TELNET" duration=0 sentbyte=0 rcvdbyte=0 sentpkt=0 > appcat="unscanned" crscore=30 craction=131072 crlevel=high > > --------------------------------------- > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/f5d97bc9-7207-43c3-945e-a23960955c59%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
