I guess it’s common practice to parse message into specific fields and then drop initial content of the message, to avoid unnecessary data duplication. What’s the current recommended and most performant way for that? Using Extractor + Regex replacement or via Pipeline? Actually I believe it shoul…

Best way to clear initial message field?

maniel (Daniel) October 21, 2020, 12:22pm 2

maybe this would be helpful:

Topic		Replies	Views
Drop default message field in extractors or pipelines Graylog Central (peer support)	2	5010	October 12, 2017
Graylog : Delete field automaticaly Graylog Central (peer support)	2	2191	August 24, 2017
Remove or nullify full_message field after extractors are completed? Graylog Central (peer support)	2	710	November 26, 2021
Delete fields in message Graylog Central (peer support)	2	2326	October 18, 2019
Delete a specific filed or log received Graylog Central (peer support) elastic , capacity_planning	2	41	May 22, 2025