Extractor in Graylog 3.0.0 not working

Graylog Central (peer support)
1 
I have an issue with extractors in Graylog 3.0.0. Recently I upgraded from version 2.5.1 to version 3.0.0.

In 2.5.1 I had an extractor that was working fine. I re-used after migrating to 3.0.0, but the field is no longer extracted. I even re-built it - still not working.

Under System > Inputs > Manage extractors I loaded an example message and

  • entered a string in the field “Regular expression” and tested it with the “Try” button -> the correct value is extracted
  • entered a string in the field “Field contains string” and tested it with the “Try” button -> it says “Matches! Extractor would run against this example.”

“Extraction strategy” is “Copy”.

But when I press “Update extractor” nothing is actually extracted.

How can I debug whats going on?

2

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.