Different Message data on Elastich and Output

Graylog Central (peer support)
1

Hi,
I have this need. Using Graylog I have some logs (managed with pipeline/extractor etc).
Then I send these messages to kakfa output.

Now I need to reduce Message data before it is written on Elastic, but I need it (complete) for my output.
Is this possible?

Thanks
Gianluca

2

Currently you can only output what is written to Elasticsearch - so no difference is possible.

3

Thanks.
So can you tell me if is possible to exclude Elastic write operation instead?

4

you can only drop messages - that is currently the only given option.

5

Thanks.
If I drop messages in some pipeline, I will lose it in the output, isn’t it?

6

If I drop messages in some pipeline, I will lose it in the output, isn’t it?

correct

7

So there is no way to exclude data in ElasticSearch but send it in my output

8

that is what I already have written.

2 Likes
9

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.