Correct mapping for gl2_message_id

[gsmith]

Hello,

@nisow95612

Is this Mapping correct?

Yes, gl2_message_id is the identifier for each unique message It will be set to a ULID during processing. . As far as I know it acts like _id .Using ULIDs results in shorter IDs (26 characters for ULID vs 36 for UUID) and thus reduced storage usage.

• Alert Server Changes - Implement message ID field · Issue #5994 · Graylog2/graylog2-server · GitHub

@nisow95612

or I can disable inverted index feature and free 1.5% of my disk?

I haven’t seen someone do that, but if you get it to work without breaking it, I would be curious to see how you went about doing it.

So on that note, In this post below I showed the _id and the gl2_message_id

Searching by message id

@wadimsewo Hello, Think I may have found the solution. [image] I believe what you were searching for “1de348d0-a422-11eb-93b2-02422a41f7ab” is the permalink for the message. Example as shown below. [image] Also I found this EDIT: If your using GL4 try something like this. Insead of using gl2_message_id use _id: 1de348d0-a422-11eb-93b2-02422a41f7ab and search for ALL message see if you find it. Example: [image] I tried it on a couple messages and it worked for me. Hope that help…

As you can see I can search with both of them, I also use this ${message.id}. So again I’m not sure. To be honest I would use a dev VM and try to adjust it to your needs and see happens. By chance have you posted in GitHub about this? I would think that one of the staff members would be able to answer this question with more detail.

EDIT: I forgot to mention if gl2_message_id is a concern have you thought about creating a custom index?

`