We have updated our Terms of Service, Code of Conduct, and Addendum.

spliting 2 types of events from single syslog stream based on event data fields

ledion
ledion Posts: 2 mod
in General Discussions

Hi community, I've a requirement of spliting 2 types of events from single syslog stream based on event data fields like "appname=='CEF'". I tried the following filter in data routes and was hoping it will work: __inputId.startsWith('syslog:in_syslog:') && appname=='CEF' But unfortunately it's not working. I already went through the Cribl documentation(https://sandbox.cribl.io/coursedocs/expressions/docs/filters) but I'm not sure where exactly the filter condition fails to filter the events.

Answers

  • Oliver Hoppe
    Oliver Hoppe Posts: 50 ✭✭

    Hi Manish, does the event contain a field appname=CEF already as a field or is it within the _raw field? If the latter one you will need to either split the field out in a preprocessing pipeline or use another filter condition like _raw.includes('CEF') Could you share an anomized sample event here?

  • ledion
    ledion Posts: 2 mod

    Hi Oliver, This seems to be fixed now. Actually I didn't notice that the syslog stream was consumed completely in a prior data route which was set as final. So there was no data forwarded to the subsequent data route.

  • Oliver Hoppe
    Oliver Hoppe Posts: 50 ✭✭

    :wink:

  • Oliver Hoppe
    Oliver Hoppe Posts: 50 ✭✭

    glad you found the problem.

Categories