Nagios Support Forum

Hopefully it gives you something useful

Not yet. I'm actually at a customer's site in Philly this week, installing NLS and NNA and NXI for them. I thought I could try it out on their system real quick but I just have the syslog and eventlog input filters right now. Might have to wait until I get home.

I assume if you're using Windows event logs, you should have a field for username, see if there is a username.raw field, and try your search on that.

Sorry, but my requirement is do do a global query. The username CarlS could be in different fields ranging from WIndows eventlogs to F5 Load Balancer logs, to SHarePoint IIS logs. If sudddenly we notice there is a user 'CarlS-' doing some things it is not supposed to do, we need to search all logs for 'CarlS-' and only get logs for 'CarlS-'.... Is this a global ELK issue or specific to NLS?

This is a global ELK problem.

You can duplicate as many fields as you want using the raw solution that hsmith posted, and then you'd be able to search using regex across all fields.

If I can come up with a better solution, I'll reach out and let you know.

Looking forward to that better solution. Teaching clients that typing "field_name.raw:thing_to_look_for" is required, rather than just "thing_to_look_for" is not a long-term viable solution for us.

eloyd wrote:Looking forward to that better solution. Teaching clients that typing "field_name.raw:thing_to_look_for" is required, rather than just "thing_to_look_for" is not a long-term viable solution for us.

As am I. It's something that I'm researching. Switching to the WhiteSpace analyzer might be a possibility, but I can't promise it is going to not break current installations. I will need to test this.

Agreed. It's not a big deal (now) but as our base of users that just want to search for stuff for their helpdesk people to find missing emails, busted logons, etc, limitations of the parser will become increasingly awkward to work around.

One option would be to allow multiple parsers to be used, but to make it an advanced configuration option so people who know what they're doing inside elasticsearch can take advantage of the different analyzers.

I'll have to sit down with Jake and Scott and figure out what the best route to take is.