# Extracted fields are not searchable

**URL:** <https://community.graylog.org/t/extracted-fields-are-not-searchable/20626>\
**Category:** Graylog Tech Challenges\
**Created:** [July 25, 2021, 8:39am UTC](https://community.graylog.org/t/extracted-fields-are-not-searchable/20626 "2021-07-25T08:39:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![badihi](https://avatars.discourse-cdn.com/v4/letter/b/59ef9b/32.png) [@badihi](https://community.graylog.org/u/badihi)\
**Post date:** [July 25, 2021, 8:39am UTC](https://community.graylog.org/t/extracted-fields-are-not-searchable/20626/1 "2021-07-25T08:39:17Z")

</div>

I have some extractors to extract logs coming in JSON format from a source. I realized that resulting fields from extractors are not searchable (but original fields are) and probably are not indexed.  
This is the pipeline of extractors: `Replace with regular expression -> JSON -> Copy input`  
Is it a normal behavior, or am I doing something wrong?

---

<div class="post-metadata">

**Author:** ![dscryber](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/dscryber/32/14178_2.png) [@dscryber](https://community.graylog.org/u/dscryber)\
**Post date:** [July 26, 2021, 4:47pm UTC](https://community.graylog.org/t/extracted-fields-are-not-searchable/20626/2 "2021-07-26T16:47:54Z")

</div>

Hello,

Moving your question to Daily Challenge for potential responses. Please be sure to add input or output data and screenshots. Visuals and examples typically accelerate responses.

Have you checked out these similar posts and links?

> [@JSON extractor not working](https://community.graylog.org/t/json-extractor-not-working/16669/3):
>
> otherwise if it can be done with grok or regex any guidance on this would be great Im trying to get this last bit working in order to get my boss to approve the license for several customer sites

[https://docs.graylog.org/en/4.1/pages/extractors.html](https://docs.graylog.org/en/4.1/pages/extractors.html)

---

<div class="post-metadata">

**Author:** ![0x3e4](https://avatars.discourse-cdn.com/v4/letter/0/b9e5f3/32.png) [@0x3e4](https://community.graylog.org/u/0x3e4)\
**Post date:** [August 6, 2021, 6:12am UTC](https://community.graylog.org/t/extracted-fields-are-not-searchable/20626/3 "2021-08-06T06:12:56Z")

</div>

hey @dscryber  
try to use “regular expression” instead “replace with regular expression”… also show us some screenshots of the extractor and a test message. what does the test show you inside of the extractor?  
i just can say that i can search my keywords which i made with “regular expression”.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [August 20, 2021, 6:13am UTC](https://community.graylog.org/t/extracted-fields-are-not-searchable/20626/4 "2021-08-20T06:13:15Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.