Conditional extractor

Graylog Central (peer support)
1

I’m trying to process input from filebeat which delivers data from multiple log files but I’m not sure how I an accomplish this in Graylog. Basically filebeat sends different messages each with different “type” fields (e.g. “app1_log”, “app2_log”, etc.).
Since each app has a different log format I need to be able to define multiple extractors but only run each if the “type” field has a certain value. Something along the lines of:

if message.type == "app1_log"
  apply extractor_app1
else if message.type == "app2_log"
  apply extractor_app2
...

How can I accomplish this?

Regards,
Dennis

2

You can use the processing pipelines for this: http://docs.graylog.org/en/2.2/pages/pipelines.html

3

That’s exactly what i was looking for thanks!