Should I need raw data to create a Grok Filter?

Elastic Stack Logstash
1

Hi , I am a new user to use ELK.
I want to analyze Aruba Controller & MM's syslog.
But ELK don't have Aruba's template to show clearly.
So I need to grok it by myself.

From some article ,I know that ELK will not save the raw data
Should I output raw data of Aruba's syslog to try to grok it ?
Or did I have another way to make the default "type:syslog" more clearly?

Thanks

2

I can't understand.
If I can't read raw logs .
How could I grok it?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.