I have added a new extractor to an input which creates a new field. If I “try” the extractor it works on messages however the new field isn’t created.
I edited some extractors that have existing fields and those are working properly.
What needs to be done in order to add a new field to an existing index?
Also tried rotating the index and restarting graylog.
what have you done exactly and how did you configured your extractor?
You might have something configured differently on your new extractor than on the old ones.
Jan
It turned out to be the sort of the extractors. It added the extractor to the top of the list and it depended on an extractor later in the chain.
It was confusing because when I tested from within the extractor, it worked successfully.
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
