Extractor per stream?

Graylog Central (peer support)
1

Hi,

I have filebeat on a host scraping many different types of logs and sending them to a graylog’s beats input.
All of these logs are different though (as I run different things on this host).

They all enter the same input, but I have separated them into different streams using rules that use “file” (i.e., filename) filters. So now I have all the different types of logs all separated out and I have alerts for errors, etc.

Now I’d like to do something like “extractors” on each stream. I know how to do them on each input, but in my case, all my logs are entering the same input.

Is there a way forward possible for me now? Is there a different way to achieve the same effect?

Thanks

2

hi,

you can use processing pipelines for that purpose. See http://docs.graylog.org/en/2.4/pages/pipelines.html

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.