I created a new field called history_cmd using a extractor, but I noticed I can’t use this field to search (history_cmd: “ls -l”), in the graylog documentation I found 2 information about search, but I still don’t understand if new fields created by a extractor are searchable…
P.S. If I am using message: field, the search works very well.
The search syntax is very close to the Lucene syntax. By default all message fields are included in the search if you don’t specify a message field to search in.
Also note that message, full_message, and source are the only fields that are being analyzed by default. While wildcard searches (using * and ?) work on all indexed fields, analyzed fields will behave a little bit different. See wildcard and regexp queries for details.