Custom fields are searchable?

Graylog Central (peer support)
1

Hi,

I created a new field called history_cmd using a extractor, but I noticed I can’t use this field to search (history_cmd: “ls -l”), in the graylog documentation I found 2 information about search, but I still don’t understand if new fields created by a extractor are searchable…

P.S. If I am using message: field, the search works very well.

Link http://docs.graylog.org/en/2.2/pages/queries.html

The search syntax is very close to the Lucene syntax. By default all message fields are included in the search if you don’t specify a message field to search in.

Also note that message, full_message, and source are the only fields that are being analyzed by default. While wildcard searches (using * and ?) work on all indexed fields, analyzed fields will behave a little bit different. See wildcard and regexp queries for details.

2

I still having this issue, someone can help?

3

Hej Leonardo,

you might want to define a custom index mapping.

regards
Jan

4

Hi,

First of all, thanks Jan

I read the link, and this only will affect new index created by graylog? Is there any way to apply to current index?

5

Hej,

yes the custom mapping is only for new indices - please use your preferred search to find how to change the mapping of elasticsearch indices.

thank you