Hi all. I'm receiving messages following the pattern key=value. I'd like to set the value of two of the received keys on graylog standard fields, namely "message" and "timestamp" and discard the original fields completely.
I can use the "key=value" converter, then "copy" the original field's content and set the value on graylog fields, however the unnecessary fields (msg, and time) remain on the log. Using the cut option causes the field value to be set with the value "fullyCutByExtractor". The question is: Why it's not possible to remove a field from the received message using extractors? I believe having to drop fields is something usual.?! I've checked the docs (haven't tried yet), and it's possible to accomplish what I want using the pipelines feature. However it's in an experimental phase (with potential stability and performance issues) and it seems overkill for doing something so simple as dropping a field. Thanks. -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/6bd8d93a-9dfe-448e-93bc-9644e589a221%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
