search

graylog-labs / graylog2-web-interface

[DEPRECATED]
https://www.graylog.org/
611 stars 174 forks source link

Input frame delimiter #1595

Closed ghost closed 9 years ago

ghost commented 9 years ago

I want to send SIP/TCP messages to graylog2 and get them indexed as messages. But graylog2 is delimiting based on newline character and reading line by line in single SIP messages and showing each line as seperate messages. Is there a way to read complete SIP message as one? I have already tried null byte delimiter.

joschi commented 9 years ago

Graylog currently doesn't support browsing SIP messages. Since this is a very special use case, it's rather unlikely that the core project will ever ship a SIP codec which would be required to do so.

Feel free to add your suggestion to our product portal at https://www.graylog.org/product-ideas/ or write (and publish :wink:) a SIP codec on your own (https://github.com/Graylog2/graylog2-server/blob/1.1.6/graylog2-plugin-interfaces/src/main/java/org/graylog2/plugin/inputs/codecs/Codec.java).

ghost commented 9 years ago

Ok. Is there any other way that I could club the lines based on something like tcp socket (source ip: source port) and form 1 message, may be using some extractors?

joschi commented 9 years ago

@Prakashmitech Graylog currently doesn't support assembling messages from separate incoming messages.