Best way to clear initial message field?

Graylog Central (peer support)
1

I guess it’s common practice to parse message into specific fields and then drop initial content of the message, to avoid unnecessary data duplication.
What’s the current recommended and most performant way for that?
Using Extractor + Regex replacement or via Pipeline?

Actually I believe it should be out-of-the box function, to make it work just in 1 click with some checkbox, as it’s really basic thing

2

maybe this would be helpful:

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.