Some logs, i.e. TACACS, return multiple keys values with the same key name. One log returned may be similar to the following: Username=test 1 AuthorizedGroup="RAS Users" AuthorizedGroup="VPN Users" AuthorizedGroup="Router Access"
What is the best way for graylog to process these types of logs without an find and replace extractor renaming the first match to something else and then creating another to do the second one and so forth? -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/956d9956-1491-4aad-81b9-2f5ca2658b6b%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
