Custom fields are searchable?

(Leonardo) #1


I created a new field called history_cmd using a extractor, but I noticed I can’t use this field to search (history_cmd: “ls -l”), in the graylog documentation I found 2 information about search, but I still don’t understand if new fields created by a extractor are searchable…

P.S. If I am using message: field, the search works very well.


The search syntax is very close to the Lucene syntax. By default all message fields are included in the search if you don’t specify a message field to search in.

Also note that message, full_message, and source are the only fields that are being analyzed by default. While wildcard searches (using * and ?) work on all indexed fields, analyzed fields will behave a little bit different. See wildcard and regexp queries for details.

(Leonardo) #2

I still having this issue, someone can help?

(Jan Doberstein) #3

Hej Leonardo,

you might want to define a custom index mapping.


(Leonardo) #4


First of all, thanks Jan

I read the link, and this only will affect new index created by graylog? Is there any way to apply to current index?

(Jan Doberstein) #5


yes the custom mapping is only for new indices - please use your preferred search to find how to change the mapping of elasticsearch indices.

thank you