I have an input that previously had an extractor that has since been deleted. However when a new log matches the old extractor criteria, it still runs. It’s like it’s hidden and I can no longer edit or completely remove it. The old extractor would create a new field if data matched a regular expression.
Does anyone have any ideas what could cause behavior like this?
My Environment details:
GrayLog - 15 Nodes running: 2.4.6
Elasticserach - 8 Data Nodes running: 5.6.9
MongoDB - 3 Nodes in a replica set running: 3.6.8