Custom field, how to break down per word rather than the full string

Graylog Central (peer support)
1

Hi, is there a way to reproduce the behavior of the message field in a custom field?
I.e. Break down per word rather than limited to full string?

My use case is the following:
I have a custom field named “loggerName” which contains string values such as “java.util.concurrent”, “com.hibernate.stats”, “org.apache.commmons”, etc.

I created an extractor (Replace with regular expression) to replace dots to whitespaces.
However when I chose “quick value” it shows a break down per “full string”.

Actual result:
“java.util.concurrent”
“com.hibernate.stats”
“org.apache.commons”

Expected result:
java
util
concurent
com
hibernate
stats
org
apache
commons

Thank you.

2

Hej Hugo,

did you like to have them separated into different fields? Then you should use Extractors/Pipeline for that.

If you like to have this analyzed than you need to create a custom Elasticsearch Mapping http://docs.graylog.org/en/2.2/pages/configuration/elasticsearch.html#custom-index-mappings