Sure, but I'm thinking of this from a usability perspective. A lot of
people will have lots of extractor rules, so having a "replace extractor"
option just makes more sense (to me ;-)
(I've had serious issues with filling the heap cache recently that just
makes me want to avoid triggering it again
Could you pause processing while you do the export/import?
On Sun, Mar 6, 2016 at 3:15 PM, Jason Haar wrote:
> Hi there
>
> I have a bunch of extractor rules for our syslog INPUT. That means I
> actually have a UDP, TCP and TCP/TLS INPUT channel for syslog - and
> obviously want the extractors t
Hi there
I have a bunch of extractor rules for our syslog INPUT. That means I
actually have a UDP, TCP and TCP/TLS INPUT channel for syslog - and
obviously want the extractors to be the same over the three of them
Currently I have to edit one of them, get new changes working, and then
delete all
