Hello All, Due to limited functionality with statistical capabilities with graylog2 we are looking to forward our modified logs to Splunk that has a limited license.
Now, sending the raw data as an output from graylog is fairly easy with an existing plugin on the marketplace. However, we are trying to minimize the amount of data and would like to send only 4 fields (out of 25) from the original message. One of the things we thought of using was a pipeline rule that creates a new message but based on graylog2 doc it does not allow you to set specific fields. Any idea on how to accomplish this would be great! In case you know of a way on how to perform a comparison of the past 30 day hourly average with the last hour event rate that would be even better! Thanks, Jonathan V. -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/f97d20ba-7dbb-4c18-8538-f58f02586559%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
