Comment on Centralising logs with rsyslog and parsing them with Graylog extractorsparentComments−dozzie8yThat's why Graylog requires you to load a log entry example when creating an extractorSo it still fails silently when the log format changes slightly, e.g. upstream fixes spelling or grammar in one of the log messages produced.−babolivierOP8yYep. You might be able to configure Graylog to alert you when an extractor fails, but I didn't go this far (as I said, we switched to another solution since then).
Comments
So it still fails silently when the log format changes slightly, e.g. upstream fixes spelling or grammar in one of the log messages produced.
Yep. You might be able to configure Graylog to alert you when an extractor fails, but I didn't go this far (as I said, we switched to another solution since then).