Can

[tomabus]

Getting a 'error: cannot POST' message with the new release. I reverted to last week's version of the content pack and it's mostly fine (apart from the Pipeline bit, which is throwing the same error). Pretty awesome content pack otherwise! Thanks

[hackdefendr]

What version of graylog are you running? I created the content packs from graylog v3.3. Not sure about the POST error, let me run some tests and see what happens.

[hackdefendr]

I see the error, somehow when creating a new version it duplicated some of the content. I fixed that and uploaded a new version.

[tomabus]

Hey, sorry for the late reply! Running v3.3. I'll try the new version of your pack and will let you know. Thanks for the hard work!

[tomabus]

yeah that's working fine now, thanks! The new dashboard looks good. I can't get the map to show anything, eventhough i installed the mmdb and enable the geolocation processor, is there anything else required? Gonna let the inputs flow for a day and see how it goes, but this is a really nice project, especially as XG's own logs and viewer are pretty limited to say the least...

[hackdefendr]

Something I noticed is that the Geolocation data doesn't show right in the log data. You have to expand the log to view it in the logs. For the map, I remember it taking a couple of hours to build the geo cache.

Also make sure to edit the widgets and change the query string:

In the query string I excluded my internal subnet from the src_ip field since geolocation won't work on internal IP's.

[tomabus]

Thanks, I'll have a look! Out of curiosity, to you use graylog for XG's email logs too? Wondering if there's a way to filter the results to only view mail logs. The mail logs view in XG is attrocious...

[hackdefendr]

Hey...sorry, busy week.

No I am not running email through my XG, but I included a Pipeline rule for XG SMTP Type that may be what you are after. It should be easy enough to create a stream in graylog for just SMTP Type logs.

[tomabus]

Thanks, i hadn't seem that pipeline rule, i'll use that. Thanks for your help!