Can I create extractor on All Event stream?

Graylog Central (peer support)
1

Graylog version: v3.3.0+4ea5649

Hi everyone,

I tried to create extractor from the message shown in All Event stream but failed with the following error message.

graylog_failed1
graylog_failed11896×882 32.9 KB

Here’s my questions:

1) Is that it is not supported to create extractor from the All Event stream?

  1. I created some custom fields from Alert’s event definition, but I can’t see any value from the field “fields”, please see the image below. Is this also one of the limitations?

graylog_failed2
graylog_failed2914×400 20.1 KB

graylog_failed3
graylog_failed31485×438 24 KB

Thanks in advance!

2

the processing pipelines does not work on the event and system events stream as this messages does not have the same message flow as a message that is ingested via your inputs.

That is the reason you can’t created extractors here or make a processing pipeline work on that messages.

3

Thanks @jan again for the explanation :pray:.

4

I have created an issue for that

because that is not the right behaviour.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.