I checked the message processing setting thru the API-Browser to make sure all Graylog nodes have the correct settings. They all report back
{ "processor_order": [ "org.graylog.plugins.pipelineprocessor.processors.PipelineInterpreter", "org.graylog2.messageprocessors.MessageFilterChainProcessor", "org.graylog.plugins.map.geoip.processor.GeoIpProcessor" ], "disabled_processors": [] } So still the open question... what is going on with the GeoIpProcessor and why is it ignoring custom fields. -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/4aae168f-2119-4d69-bab7-0621de7abfe1%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.