Hi all, I need to create an extractor copying “gl2_remote_ip” to another field. In the “add extractor” GUI I see no means to select gl2_remote_ip as the source field. My workaround was to create an extractor for another field, export it, modify the source field in “gl2_remote_ip” and reimporting it.
Is this procedure correct? Can I do the same without resorting to extract/import? More generally, can “gl2_*” fields be visible in the “add extractor” page (I know they are hidden by default)?
Full disclosure: I need to overwrite the “source” field of specific syslog messages with the correct hostname. Due to increased load on the DNS, I would like to avoid rDNS lookup; at the same time, I am trying to avoid to create a dedicate input (whose “source” can be overwritten in the input configuration).
I create as CSV table with key/value as gl2_remote_ip/hostname and, via a lookup extractor, I used this table to replace “source” with the correct hostname value.
All seems working now; is there anything I should be aware of?