Hi there I've been testing graylog for a few weeks now and I think I'm noticing a few "gotchas" I've whacked myself with.
eg I saw an example extractor that created a "src_ip" field - that mapped to an IP address. "Well", I thought, "that's no good - it's only matches IPv4 addresses", so since then I've decided to use "src_ipv4" instead as it's more explicit But then I found some unrelated kibana documentation regarding elasticsearch referring to "src_ip" - which started making me feel like that change was a bad idea... Maybe "src_ip" is sort of the standard field name for an IP address?? So are there any standard field naming conventions that should be abided by? Obviously elasticsearch is meant to be arbitrarily extendable, but I'm concerned I'll try some plugin later and it won't work because I've fiddled with fieldnames when I shouldn't have, etc -- Cheers Jason Haar Corporate Information Security Manager, Trimble Navigation Ltd. Phone: +1 408 481 8171 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/55DADF60.9020701%40trimble.com. For more options, visit https://groups.google.com/d/optout.
