# Extractor kills outgoing traffic **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [June 19, 2023, 7:47am UTC](https://community.graylog.org/t/extractor-kills-outgoing-traffic/29216 "2023-06-19T07:47:49Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Marvin1](https://avatars.discourse-cdn.com/v4/letter/m/ecb155/32.png) [@Marvin1](https://community.graylog.org/u/Marvin1)\ **Post date:** [June 19, 2023, 7:47am UTC](https://community.graylog.org/t/extractor-kills-outgoing-traffic/29216/1 "2023-06-19T07:47:49Z")
Hello Guys, a few moth ago i created extractors for my Sophos firewall, these worked properly. Now a new Firewall come to my Graylog, I created new extractors but these killed my outgoing Traffic. Only src\_ip=([^\s]_) and log\_component=“([^”]_)" work. As an example when i add dst\_ip=([^\s]\*) it dosnt work ☹ On: Debian 10 Graylog 5.1.2 ## Extractor configuration Regular expression: dst\_ip=([^\s]\*) (try → correct ip) Condition: Only attempt extraction if field contains string Field contains string: device=“SFW” (try → Matches! Extractor would run against this example.) Store as field: fW\_dst\_ip Extraction strategy: copy Extractor title: Sophos Destination IP I tried to give graylog and elastic more cores and RAM. Use cut instead of copy. Rename everything. Use “Always try to extract” and “Only attempt extraction if field matches regular expression” Hope some one had a similar problem and can help me Greetings ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [June 20, 2023, 1:35am UTC](https://community.graylog.org/t/extractor-kills-outgoing-traffic/29216/2 "2023-06-20T01:35:46Z")
Hey @Marvin1 I have something similar. dstip=+?((?:\d+.){3}\d+).+ ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/9/9ab9572471f16454e570d6d816edc4ff88a8d0ad.png) I would check tyou resources when enabling that Extractor by using TOP or HTOP. along with tailing your graylog log file, something like this. ```auto tail -f /var/log/graylog-server/server.log ``` ---
**Author:** ![Marvin1](https://avatars.discourse-cdn.com/v4/letter/m/ecb155/32.png) [@Marvin1](https://community.graylog.org/u/Marvin1)\ **Post date:** [June 20, 2023, 7:08am UTC](https://community.graylog.org/t/extractor-kills-outgoing-traffic/29216/3 "2023-06-20T07:08:31Z")
Thanks for your response: htop: before ![Unbenannt](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/9/98f5f3357bc26c9d9e9efabe991547edb81d09fc.png) after ![Unbenannt2](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/6/6e1b0991f8be213e486cc37b9f4bb922e0a23566.png) logs Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.graylog2.log4j.MemoryLimitedCompressingFifoRingBuffer.add(MemoryLimitedCompressingFifoRingBuffer.java:76) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.graylog2.log4j.MemoryAppender.append(MemoryAppender.java:83) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.core.config.AppenderControl.tryCallAppender(AppenderControl.java:161) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.core.config.AppenderControl.callAppender0(AppenderControl.java:134) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.core.config.AppenderControl.callAppenderPreventRecursion(AppenderControl.java:125) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.core.config.AppenderControl.callAppender(AppenderControl.java:89) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.core.config.LoggerConfig.callAppenders(LoggerConfig.java:542) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.core.config.LoggerConfig.processLogEvent(LoggerConfig.java:500) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.core.config.LoggerConfig.log(LoggerConfig.java:483) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.core.config.LoggerConfig.log(LoggerConfig.java:417) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.core.config.AwaitCompletionReliabilityStrategy.log(AwaitCompletionReliabilityStrategy.java:82) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.core.Logger.log(Logger.java:161) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.spi.AbstractLogger.tryLogMessage(AbstractLogger.java:2205) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.spi.AbstractLogger.logMessageTrackRecursion(AbstractLogger.java:2159) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.spi.AbstractLogger.logMessageSafely(AbstractLogger.java:2142) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.spi.AbstractLogger.logMessage(AbstractLogger.java:2040) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.spi.AbstractLogger.logIfEnabled(AbstractLogger.java:1907) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.apache.logging.slf4j.Log4jLogger.error(Log4jLogger.java:309) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.graylog.storage.elasticsearch7.MessagesAdapterES7.logFailures(MessagesAdapterES7.java:152) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.graylog.storage.elasticsearch7.MessagesAdapterES7.bulkIndexChunked(MessagesAdapterES7.java:136) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.graylog2.indexer.messages.ChunkedBulkIndexer.index(ChunkedBulkIndexer.java:43) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.graylog.storage.elasticsearch7.MessagesAdapterES7.bulkIndex(MessagesAdapterES7.java:108) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.graylog2.indexer.messages.Messages.lambda$runBulkRequest$6(Messages.java:225) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at com.github.rholder.retry.AttemptTimeLimiters$NoAttemptTimeLimit.call(AttemptTimeLimiters.java:78) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at com.github.rholder.retry.Retryer.call(Retryer.java:160) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.graylog2.indexer.messages.Messages.runBulkRequest(Messages.java:225) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.graylog2.indexer.messages.Messages.bulkIndexRequests(Messages.java:148) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.graylog2.indexer.messages.Messages.bulkIndex(Messages.java:140) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.graylog2.indexer.messages.Messages.bulkIndex(Messages.java:120) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.graylog2.outputs.ElasticSearchOutput.writeMessageEntries(ElasticSearchOutput.java:103) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.graylog2.outputs.BlockingBatchedESOutput.flush(BlockingBatchedESOutput.java:129) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.graylog2.outputs.BlockingBatchedESOutput.writeMessageEntry(BlockingBatchedESOutput.java:110) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.graylog2.outputs.BlockingBatchedESOutput.write(BlockingBatchedESOutput.java:92) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at org.graylog2.buffers.processors.OutputBufferProcessor$1.run(OutputBufferProcessor.java:189) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:180) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at java.base/java.util.concurrent.FutureTask.run(Unknown Source) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) Jun 20 08:56:00 mon1 graylog-server[60972]: #011at java.base/java.lang.Thread.run(Unknown Source) Jun 20 09:01:14 mon1 graylog-server[60972]: 2023-06-20 09:01:14,041 outputbuffer-processor-executor-1 ERROR An exception occurred processing Appender graylog-internal-logs java.lang.NullPointerException: Cannot invoke “com.github.luben.zstd.ZstdOutputStream.close()” because “this.compressedStream” is null Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.graylog2.log4j.MemoryLimitedCompressingFifoRingBuffer.flush(MemoryLimitedCompressingFifoRingBuffer.java:95) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.graylog2.log4j.MemoryLimitedCompressingFifoRingBuffer.add(MemoryLimitedCompressingFifoRingBuffer.java:76) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.graylog2.log4j.MemoryAppender.append(MemoryAppender.java:83) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.core.config.AppenderControl.tryCallAppender(AppenderControl.java:161) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.core.config.AppenderControl.callAppender0(AppenderControl.java:134) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.core.config.AppenderControl.callAppenderPreventRecursion(AppenderControl.java:125) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.core.config.AppenderControl.callAppender(AppenderControl.java:89) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.core.config.LoggerConfig.callAppenders(LoggerConfig.java:542) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.core.config.LoggerConfig.processLogEvent(LoggerConfig.java:500) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.core.config.LoggerConfig.log(LoggerConfig.java:483) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.core.config.LoggerConfig.log(LoggerConfig.java:417) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.core.config.AwaitCompletionReliabilityStrategy.log(AwaitCompletionReliabilityStrategy.java:82) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.core.Logger.log(Logger.java:161) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.spi.AbstractLogger.tryLogMessage(AbstractLogger.java:2205) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.spi.AbstractLogger.logMessageTrackRecursion(AbstractLogger.java:2159) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.spi.AbstractLogger.logMessageSafely(AbstractLogger.java:2142) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.spi.AbstractLogger.logMessage(AbstractLogger.java:2040) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.apache.logging.log4j.spi.AbstractLogger.logIfEnabled(AbstractLogger.java:1907) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.apache.logging.slf4j.Log4jLogger.error(Log4jLogger.java:309) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.graylog.storage.elasticsearch7.MessagesAdapterES7.logFailures(MessagesAdapterES7.java:152) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.graylog.storage.elasticsearch7.MessagesAdapterES7.bulkIndexChunked(MessagesAdapterES7.java:136) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.graylog2.indexer.messages.ChunkedBulkIndexer.index(ChunkedBulkIndexer.java:43) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.graylog.storage.elasticsearch7.MessagesAdapterES7.bulkIndex(MessagesAdapterES7.java:108) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.graylog2.indexer.messages.Messages.lambda$runBulkRequest$6(Messages.java:225) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at com.github.rholder.retry.AttemptTimeLimiters$NoAttemptTimeLimit.call(AttemptTimeLimiters.java:78) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at com.github.rholder.retry.Retryer.call(Retryer.java:160) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.graylog2.indexer.messages.Messages.runBulkRequest(Messages.java:225) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.graylog2.indexer.messages.Messages.bulkIndexRequests(Messages.java:148) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.graylog2.indexer.messages.Messages.bulkIndex(Messages.java:140) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.graylog2.indexer.messages.Messages.bulkIndex(Messages.java:120) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.graylog2.outputs.ElasticSearchOutput.writeMessageEntries(ElasticSearchOutput.java:103) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.graylog2.outputs.BlockingBatchedESOutput.flush(BlockingBatchedESOutput.java:129) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.graylog2.outputs.BlockingBatchedESOutput.writeMessageEntry(BlockingBatchedESOutput.java:110) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.graylog2.outputs.BlockingBatchedESOutput.write(BlockingBatchedESOutput.java:92) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at org.graylog2.buffers.processors.OutputBufferProcessor$1.run(OutputBufferProcessor.java:189) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:180) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at java.base/java.util.concurrent.FutureTask.run(Unknown Source) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) Jun 20 09:01:14 mon1 graylog-server[60972]: #011at java.base/java.lang.Thread.run(Unknown Source) hope this gives more information ---
**Author:** ![ihe](https://avatars.discourse-cdn.com/v4/letter/i/a88e57/32.png) [@ihe](https://community.graylog.org/u/ihe)\ **Post date:** [June 20, 2023, 7:38am UTC](https://community.graylog.org/t/extractor-kills-outgoing-traffic/29216/4 "2023-06-20T07:38:54Z")
could you please post one of the lines of log you want to parse? I’d suggest to use a Grok pattern. Those run only once, and possibly only on the right messages. Running a regex on every message is quite expensive on the CPU. Do you have error messages for unindexed logs? ---
**Author:** ![Marvin1](https://avatars.discourse-cdn.com/v4/letter/m/ecb155/32.png) [@Marvin1](https://community.graylog.org/u/Marvin1)\ **Post date:** [June 20, 2023, 10:57am UTC](https://community.graylog.org/t/extractor-kills-outgoing-traffic/29216/5 "2023-06-20T10:57:22Z")
Yes there are error logs but this is a different story `[466]: index [graylog_157], type [_doc], id [13915622-0f56-11ee-a4ab-00155d0fc30c], message [ElasticsearchException[Elasticsearch exception [type=illegal_argument_exception, reason=Limit of total fields [1000] has been exceeded]]]` device=“SFW” date= time=12:28:47 timezone=“” device\_name=“” device\_id= log\_id=log\_type=“Firewall” log\_component=“” log\_subtype=“” status=“Allow” priority=Information duration=0 fw\_rule\_id= fw\_rule\_name=“” fw\_rule\_section=“Local rule” nat\_rule\_id=0 nat\_rule\_name=“” policy\_type=1 sdwan\_profile\_id\_request=0 sdwan\_profile\_name\_request=“” sdwan\_profile\_id\_reply=0 sdwan\_profile\_name\_reply=“” gw\_id\_request=0 gw\_name\_request=“” gw\_id\_reply=0 gw\_name\_reply=“” sdwan\_route\_id\_request=0 sdwan\_route\_name\_request=“” sdwan\_route\_id\_reply=0 sdwan\_route\_name\_reply=“” user\_name=“” user\_gp=“” iap= ips\_policy\_id= appfilter\_policy\_id= application=“” application\_risk= application\_technology=“” application\_category=“” vlan\_id=“” ether\_type=Unknown (0x0000) bridge\_name=“” bridge\_display\_name=“” in\_interface=“” in\_display\_interface=“” out\_interface=“” out\_display\_interface=“” src\_mac= dst\_mac= src\_ip= src\_country\_code= dst\_ip= dst\_country\_code=1 protocol=“UDP” src\_port= dst\_port= sent\_pkts=0 recv\_pkts=0 sent\_bytes=0 recv\_bytes=0 tran\_src\_ip= tran\_src\_port=0 tran\_dst\_ip= tran\_dst\_port=0 srczonetype=“LAN” srczone=“” dstzonetype=“LAN” dstzone=“” dir\_disp=“” connevent=“” connid=“” vconnid=“” hb\_health=“” message=“” appresolvedby=“” app\_is\_cloud=0 log\_occurrence= flags= Sorry but i have to cut information out. thanks ---
**Author:** ![ihe](https://avatars.discourse-cdn.com/v4/letter/i/a88e57/32.png) [@ihe](https://community.graylog.org/u/ihe)\ **Post date:** [June 20, 2023, 11:30am UTC](https://community.graylog.org/t/extractor-kills-outgoing-traffic/29216/6 "2023-06-20T11:30:43Z")
how many different streams do you store on the index of your stream? There are more then 1000 field names used. Usually you can fix that either by spliting streams on different index sets, or by fixing some field names which are redundant/obsolete. regarding to your example log: could you provide it with bogus-data? please keep your type of log, so an IP could be 10.0.0.0 in general or a display\_name could be “John Doe” and so on. I’ll try to provide you with a Grok pattern. ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [June 20, 2023, 9:29pm UTC](https://community.graylog.org/t/extractor-kills-outgoing-traffic/29216/7 "2023-06-20T21:29:33Z")
Hey @Marvin1 Adding on to @ihe I noticed you using Graylog 5.1 and in your screenshot looks like you using Elasticsearch, what version of ES are you using? ---
**Author:** ![Marvin1](https://avatars.discourse-cdn.com/v4/letter/m/ecb155/32.png) [@Marvin1](https://community.graylog.org/u/Marvin1)\ **Post date:** [June 21, 2023, 6:41am UTC](https://community.graylog.org/t/extractor-kills-outgoing-traffic/29216/8 "2023-06-21T06:41:04Z")
hey @gsmith I use elasticsearch-oss version 7.10.2 amd64 ---
**Author:** ![Marvin1](https://avatars.discourse-cdn.com/v4/letter/m/ecb155/32.png) [@Marvin1](https://community.graylog.org/u/Marvin1)\ **Post date:** [June 21, 2023, 6:50am UTC](https://community.graylog.org/t/extractor-kills-outgoing-traffic/29216/9 "2023-06-21T06:50:28Z")
Hey @ihe i have 4 streams, but only 2 are running. The default stream and one I build for one of our hospitals. This stream has 29 rules ( for each Source must match exactly DC00.example.intern) for all sources used for this infrastructure ![Unbenannt3](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/2/2233ede6c1c251dfcf48059ed5378c1febbf7680.png) ---
**Author:** ![ihe](https://avatars.discourse-cdn.com/v4/letter/i/a88e57/32.png) [@ihe](https://community.graylog.org/u/ihe)\ **Post date:** [June 21, 2023, 1:07pm UTC](https://community.graylog.org/t/extractor-kills-outgoing-traffic/29216/10 "2023-06-21T13:07:12Z")
you are using the default index set for all your logs. my tip: 1. get your self familiar with the index model. Read this page from the docs to the end: [Index model](https://go2docs.graylog.org/5-0/setting_up_graylog/index_model.html) 2. create separate streams for different topics with separate index sets for your data. Windows logs into a windows stream, firewall into Firewall and so on 3. if this still does not help it will only affect a small part of your logs - not all streams/index sets will be flooded with too many fields. ---
**Author:** ![Marvin1](https://avatars.discourse-cdn.com/v4/letter/m/ecb155/32.png) [@Marvin1](https://community.graylog.org/u/Marvin1)\ **Post date:** [June 21, 2023, 2:17pm UTC](https://community.graylog.org/t/extractor-kills-outgoing-traffic/29216/11 "2023-06-21T14:17:07Z")
Thank you very much for your help. Its a valid solution for one of my problems. \<3 ---
**Author:** ![frantz](https://avatars.discourse-cdn.com/v4/letter/f/dbc845/32.png) [@frantz](https://community.graylog.org/u/frantz)\ **Post date:** [June 22, 2023, 8:04am UTC](https://community.graylog.org/t/extractor-kills-outgoing-traffic/29216/12 "2023-06-22T08:04:46Z")
The best solution is indeed what @ihe said. But you can also increase the limit of 1000 fields with an ElasticSearch template. For example you can set 1500 or 2000 but do not increase more or you will have performance issues. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [July 6, 2023, 8:05am UTC](https://community.graylog.org/t/extractor-kills-outgoing-traffic/29216/13 "2023-07-06T08:05:40Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.