Extractor, Define, ID, Message

Graylog Central (peer support)
1

Dear All,

I have an extractor with wrong parsing.

I found a message what it wrong parsed, but how can I found the associate extractor?

Thanks,

2

you can’t - this is not possible.

The message itseld does not have the information attached what extractor has modified the message. With the processing pipelines you could add a field that holds the name of the rule that has modified the message, but with extractors this is not possible.