Thank you stephanbuys. I feel more confident knowing others use this same method then. I have added these logs, no regex, segment 4, main index, auto detect type all except syslog I added under file list as syslog (didn't know if the others should be under syslog as well): /var/log/auth.log /var/log/cron.log /var/log/daemon.log /var/log/debug /var/log/kern.log /var/log/mail.err /var/log/mail.log /var/log/messages /var/log/syslog /var/log/user.log /var/log/uucp.log Since those are the ones syslog-ng writes. Thank you again :)) ... View more