1

Sometimes I would like to view log entries as a "standard" looking text based log file.

Right now sometimes I'll end up going to the server where the logs were generated just so I can display a block of text to follow a timeline of logs a little quicker than going through graylog. This totally defeats the purpose of having central logging, but it's still saving me time.

For example, sometimes a script needs to have debug enabled while it parses through a file with 1,000 lines of data in it. Since debug is enabled it literally spits every line it processes into the log files as it parses lines. I would like to view this as a sequential log entry file rather than each and every entry having its own object in the graylog ui.

I do realize that it has a "Show Surrounding Messages" function, but that still shows each message in an individual object in the gui.

It would be really nice to see this in a standard log view. So that it literally looks like a normal text based log.

Use Case: In troubleshooting an application behavior over a 5 minute period which consists of 700 log messages, I don't want to have to expand each message individually. It would be much more human readable if I can view these logs as a "standard" log file rather than through the GUI.

Is this possible, and if so, how can I do it? Thanks

emmdee
  • 2,187
  • 12
  • 36
  • 60
  • I think you'll have to create your own software for this. Did you know that Graylog has an [API](http://docs.graylog.org/en/2.4/pages/configuration/rest_api.html)? – Swisstone May 03 '18 at 19:24
  • Thanks, if push comes to shove I may go down that route. – emmdee May 03 '18 at 19:44

1 Answers1

0

If looking at individual files on a host works for you, sure do that. You can still benefit from centralized logging of multiple hosts, with search, dashboards, and alerts.

Graylog can export any search results as CSV.

That search can be more precise if you extract more fields to search on. Sometimes there are process IDs or request IDs that identify the chunk of lines you want.

John Mahowald
  • 32,050
  • 2
  • 19
  • 34