basic graylog search - have input pulling sophos xg logs, cannot do a simple search on data that is clearly present - graylog

short version:
I try and search on something that is clearly logged, namely: "roblox" which is in the last line of log message
it does not find it:
I've tried all your obvious "roblox" "roblox" but it either matches everything or nothing. How can I make this search work please?

Related

How to recover from split log messages in Fluent-D

There appears to be a years-long-standing issue with large ( longer than 16KB) messages getting split into parts and appearing on Kibana in multiple lines. Such long messages typically include Java exception stack traces. The splitting makes parsing and therefore indexing impossible and messes things up completely for developers who need to read the logs.
By "message" I'm referring to the field with the label "message" that appears as part of the log entry that, of course, starts with the "timestamp" field.
As much as I have searched I have not found a filter that can concatenate those parts and make them appear as a whole on a single log entry, where the JSON block can be properly parsed and indexed. I have tried a few filters of my own, with little success.
Please help if you are aware of a solution.
Thanks

Log4j2 JsonTemplateLayout issue

I am trying to set up json logging for log4j2 described here:
https://logging.apache.org/log4j/2.x/manual/json-template-layout.html
However, the format of the output is not matching what I expect. This is what I am getting:
{"#version":1,"source_host":"localhost","message":"hello world","thread_name":"main","#timestamp":"2021-08-17T15:44:54.948-04:00","level":"INFO","logger_name":"com.logging.test.LoggingTest"}
At first I created my own template but this wasn't working so I set it to the logstash one described in the docs:
<JsonTemplateLayout eventTemplateUri="classpath:LogstashJsonEventLayoutV1.json"/>
I am not getting the line number in the output or a lot of other fields. I know it is picking up the eventTemplateURI field because if I set it to a value I know doesn't exist then I get an exception on start up.
I am using log4j-slf4j-impl, does anything special need to be done to make it work with this?
Thanks

GoogleSheet: IMPORTXML error, resource at url not found?

What you will see from images below is that A1 is filled with random number which generated from the script. The number will change randomly every-time cursor is moved, it's used in method for "forcing update the XML data" in Google Sheets.
as we can see from the 1st picture, the IMPORTXML worked like charm, using =IMPORTXML("Link" &A1(which is the random number, that is needed to update the data), "//target content") recipe
Well, it worked out for the 1st link, but not really for the second one, in the 1st image, B2 is using the last link, and it shows 1736.5 as the value, that is showing fine without using &A1 code
After adding &A1 to the formula, it gives error #N/A and Resource at url not found as the error detail.
I already tried to use another cell with calculated numbers(more than A1 or less than), still gives me that error.
Solution
If you look closely to the second URL you will notice it finishes with an = sign. In URLs this symbol is used to express key values pairs. Using your refresh trick, in this case, you are specifying to the server to look for a resource that actually doesn't exist. Hence the IMPORTXML error. Just put the generated URL in the browser to see the result.
Try to put another random parameter in the URL that will cause to refresh the page without causing a 404 HTTP error.
For example:
https://www.cnbc.com/quotes/?symbol=XAU=&x=0
Won't cause any error and will give the desired result.

Advanced site search with google

I try to find out which URLs exists for a specific domain and a specific domain-path in the google index. The urls have the following schema:
https://example.org/path1/<keyword>/path2/
the following google search works fine:
site:https://example.org/path1/*/path2/
but it delivers more than 40.000 findings. So I'll try to search for
https://example.org/path1/a*/path2/
but there where no results found (what can't be). Whats wrong? Any chance to deliver only Findings where Site-URL contains keywords starting with an "a"?
Thank you,
Jan
You can try the following
https://example.org/path1/*a
This will search for all the URL's which starts with https://example.org/path1/ which also contains the keyword a
You can refine your search by specifying multiple keywords:
https://example.org/path1/*a*/path2/
This will search for the same as in the 1st example but will conatin the /path2/ part of the URL as well. However this will match URL's if the keyword a is either before or after the 2nd path /path2/

IMAP search on header not working as expected

I am building library for IMAP my search command works file for the Inbox folder it returns me a number which I can use to fetch the mail. However when I try to search on Sent Items it does not work it does not give an error but just returns Search OK without any numbers. Can you please point out why this behavior. I am hitting Exchange 2010.
My search command is something like:
search all HEADER Message-ID "<cc6aed80-955b-4800-a3ac-6c3942ceecac>"
This is exactly how it is described in http://support.microsoft.com/kb/302965
Possibly of no use, but I ran into possibly the same problem.
In a mailbox with an email from "Bill Gates ", a search with the expression '(FROM "billy#microsoft.com")' returned nothing; a search for '(FROM gates)' return a hit.
I had to change my code to '(HEADER FROM "billy#microsoft.com")' to get it to work.
ALTERNATIVELY:
You may be able to use IMAP4.uid(command, arg[, ...])
See http://docs.python.org/2/library/imaplib.html#imaplib.IMAP4.uid

Resources