Hi there!
Is there a way to simply inject syslog without any parser (because there is none available for the product itself yet) to get the raw log into the SIEM and to look into the format itself to create a parser later maybe?
How to simply inject syslog without any parser?
+1
+6- Bronze 2
I played with the MACOS log type for this. Maybe thats a good place to start. It pretty much just does the grok matching on SYSLOG formatted data.
What logs are you trying to pull through though? If you just grep syslog on this page you might find something closer to your logs to use as a base:
https://cloud.google.com/chronicle/docs/ingestion/parser-list/supported-default-parsers
+1
Hi ion,
ok, so basically it doesn't matter what data_type i choose.
I want to inject custom logs for example. I thought there is a way without explicit data_types. So that I only have a collector which is waiting on a TCP Port for syslog messages and imports/redirect them into chronicle as raw log.
Will look into your link and try it tomorrow I guess.
Thank you for the input! :)
+3as for ingesting the logs without a parser, yes. The logs will show in Chronicle as unparsed raw logs
Login to the community
Login with SSO
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.