Can I create extractor on All Event stream?

Graylog version: v3.3.0+4ea5649

Hi everyone,

I tried to create extractor from the message shown in All Event stream but failed with the following error message.

Here’s my questions:

1) Is that it is not supported to create extractor from the All Event stream?

  1. I created some custom fields from Alert’s event definition, but I can’t see any value from the field “fields”, please see the image below. Is this also one of the limitations?

Thanks in advance!

the processing pipelines does not work on the event and system events stream as this messages does not have the same message flow as a message that is ingested via your inputs.

That is the reason you can’t created extractors here or make a processing pipeline work on that messages.

Thanks @jan again for the explanation :pray:.

I have created an issue for that

because that is not the right behaviour.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.