Nagios Support Forum

upgraded to 2.1.9 - still same issue
clicking on "index status" and "cluster status" returns an error.

I'm looking to open some closed indexes so i can search them - when I try to open https://naglog.is.strath.ac.uk/nagioslo ... dex_status i get an http error 500

I'm running 2.1.7

any ideas?

anything I can do in command line?

i found out at that although each syslog line was different (and from the same host) they always started with timedate and then IP address. This IP address seemed to be a key to the log format - so I've done a partial match and then use an IF around the IP to do a further match and any mutations Sti...

I've got 2 different log formats coming in over syslog, from the same host and want to set the type field based on the format of the line. I know you can have multiple pattern matches in grok (for example at the end of this page https://coralogix.com/log-analytics-blog/logstash-grok-tutorial-with-ex...

thanks. If I save as CSV I don't get all the rich info in the details of the event, so I think I have to look at the enterprise version of nxlog. Bit of a shame.

What is the best way to upload a windows archived event file, one time (ie I have a copy of security.evtx from a machine and I want to upload it to analyse it better? Is that using NXLog and pointing to the file or using shipper.py?

cheers - will just wait for a fix

thanks - done that and its awesome!

Just one thing though - when I go to export to a CSV the field "geoip.country_name" is blank, although it has data when viewed in the web GUI. We are running version 2.0.7.

Any thoughts?

Thanks

Can we use the geoIP command that is in elastic search to give the country location? https://www.elastic.co/blog/geoip-in-the-elastic-stack. If so is it already packaged or do we need to install it somehow? Thanks

Ta Got there in the end with a few mutates and xpath Thanks mutate { gsub => ['message', '^<.*\?>', ''] replace => [ 'type', 'ePO1'] } xml { source => "message" store_xml => false xpath => { "/EPOEvent/MachineInfo/OSName/text()" => "OSName" } xpath => { "/EPOEvent/...