I have syslogs from our load balancer which has 4 servers on it. When one of the servers states changes from UP to DOWN or DOWN to UP it is reported in the syslogs as a string value in an event but ...
See more...
I have syslogs from our load balancer which has 4 servers on it. When one of the servers states changes from UP to DOWN or DOWN to UP it is reported in the syslogs as a string value in an event but sometimes a single event from the same time will contain server state changes for multiple servers. OR a single server but BOTH state change to DOWN and state change to UP. my issue is that no matter what search I use it never accurately picks up every state change for every server from any event that has multiple messages in it. Below is a sample of one of my events that has more than one state change: NOTE I want to extract ALL instances of the following message to a single field A Loadbalancer Server Status is changed to DOWN AND/OR A Loadbalancer Server Status is changed to UP LOG EXAMPLE: Aug 6 03:01:12 NSX-Edge03-0 MsgMgr[2349]: [MDCM]: payload len:770 data:{"systemEvents":[{ "moduleName":"vShield Edge LoadBalancer", "severity":"Informational", "eventCode":"30302", "message":"A Loadbalancer Server Status is changed to DOWN", "timestamp":1596708060, "metaData":{ "listener" : "Carson_MDCM_Servers", "server" : "Server69" } },{ "moduleName":"vShield Edge LoadBalancer", "severity":"Informational", "eventCode":"30301", "message":"A Loadbalancer Server Status is changed to UP", "timestamp":1596708081, "metaData":{ "listener" : "Carson_MDCM_Servers", "server" : "Server69" } },{ "moduleName":"vShield Edge LoadBalancer", "severity":"Informational", "eventCode":"30301", "message":"A Loadbalancer Server Status is changed to UP", "timestamp":1596708082, "metaData":{ "listener" : "WT_MDCM_Servers", "server" : "Server81" } }]}