I have some extractors to extract logs coming in JSON format from a source. I realized that resulting fields from extractors are not searchable (but original fields are) and probably are not indexed.
This is the pipeline of extractors: Replace with regular expression -> JSON -> Copy input
Is it a normal behavior, or am I doing something wrong?
Hello,
Moving your question to Daily Challenge for potential responses. Please be sure to add input or output data and screenshots. Visuals and examples typically accelerate responses.
Have you checked out these similar posts and links?
hey @dscryber
try to use “regular expression” instead “replace with regular expression”… also show us some screenshots of the extractor and a test message. what does the test show you inside of the extractor?
i just can say that i can search my keywords which i made with “regular expression”.
1 Like
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.