2

I've been looking for a log viewer that understands syslog messages, specifically in RFC 5424 format (including structured data elements), and ideally allows live monitoring (tail like) and filtering/searching.

The viewers and analysis tools I've tried either seem to not understand the protocol, or they swallow or ignore structured data elements.

LogAnalyzer for example seems to understand the basic syslog syntax and decodes severity and facility properly, but it's database format does not include structured data. Splunk, on the other hand, doesn't seem to parse it at all, and instead recognizes generic space separated values, and key-value pairs in the whole message. This does include the structured data, but severity/facility is not decoded.

I'm hoping to find something that either runs on windows or is web based. Does such a thing exist? After installing trials for various tools of about 3 pages worth of search results, I'm willing to pay, but free would of course be nice :)

Improve this question
2
  • I'm using logstash - it combines with elasticsearch and kibana. But I wouldn't know how to get it working on Windows. logstash does support custom filters for log parsing though.
    – Sobrique
    Jun 25, 2014 at 14:40
  • 1
    logstash, elasticsearch and kibana were actually painless to get to run on windows. Looks like I might indeed need a custom filter to parse the fields of our logs, but this doesn't look too hard at a first glance. Thank you!
    – user227884
    Jun 26, 2014 at 10:14

0

Reset to default

You must log in to answer this question.