Hi Jochen, What is strange about it is that the "Stream" rules apparently work with the field "log_message", but a search query does not work.
I send a raw Elastic query and still not much information about why it is not working. The custom mapping is useful if the data type is not the default string type. However, the log_message field is still string type. So it may not make much difference if I set up custom mapping for this field? Thanks, Wayne On Wednesday, October 19, 2016 at 12:22:32 PM UTC-4, Jochen Schalanda wrote: > > Hi Wayne, > > On Wednesday, 19 October 2016 17:36:10 UTC+2, Wayne wrote: >> >> Is there additional configuration that is required to ensure all the >> extracted fields to be searchable? >> > > See > http://docs.graylog.org/en/2.1/pages/configuration/elasticsearch.html#custom-index-mappings > > for details. > > Cheers, > Jochen > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/8876b4c5-a05a-4f58-8810-164570aec67d%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
