I have an issue with extractors in Graylog 3.0.0. Recently I upgraded from version 2.5.1 to version 3.0.0.
In 2.5.1 I had an extractor that was working fine. I re-used after migrating to 3.0.0, but the field is no longer extracted. I even re-built it - still not working.
Under System > Inputs > Manage extractors I loaded an example message and
- entered a string in the field “Regular expression” and tested it with the “Try” button -> the correct value is extracted
- entered a string in the field “Field contains string” and tested it with the “Try” button -> it says “Matches! Extractor would run against this example.”
“Extraction strategy” is “Copy”.
But when I press “Update extractor” nothing is actually extracted.
How can I debug whats going on?