Customize or Remove the message Column/Field from Graylog Search Results

Graylog Central (peer support)
1

Hi Graylog Team,

We are currently using Graylog for syslog collection and have a requirement to customize the message column/field displayed in the Graylog interface.

For example, our device is sending the following syslog message:



1L-BAU-AU14-IT1 npb: ID: 102, PORT, INFO, EVT, Port: 43 link status is down

In Graylog, the message is displayed as the standard message field, as shown in the attached screenshot.

Our requirement is to determine whether it is possible to:

  1. Hide/remove the message column from the Graylog search results.
  2. Rename/customize the message field to a different field name.
  3. Display a customized/parsed version of the message instead of the original raw message.
  4. If this is possible through Streams, Pipelines, Extractors, or Search UI configuration, could you please advise the recommended approach?
  5. Is there any configuration or customization available to control the fields shown in the message details/search results UI?

We would prefer to customize the presentation in Graylog without modifying the original syslog message being received from the network device.

Graylog message type
Graylog message type1060×372 18.6 KB

2

Hey @chandru,

Could you offer some context on why the altering or removal of the message field is required? Is this an access/permissions issuse?

3

I guess you want to parse the log into different fields, display the relevant ones and hide the blue message line in the log overview.

To parse your logs, you should use Pipelines: Pipelines for the log you displayed a grok pattern would do the job

To display new fields in the message overview you can add them here in the details of the “All Messages” Widget. Click “Edit” on the top right of the widget to reach this view:

grafik
grafik209×131 3.68 KB

And to hide the full message line with blue text, you need to uncheck those two boxes:

grafik
grafik234×103 4.35 KB