Field name stripping leading underscore

This is my print statement to stream the web server logs to graylog.

printf “{ “version”: “%s”, “host”: “%s”, “smsg”: “%s”, “_GL_environment”: “%s”, “_GL_log”: “%s”, “_GL_type”: “%s”, “_GL_ws”: “%s”, “_GL_filter_host”: “%s”, “message”: “%s” }\n”, ver, hn, smsg, env, lognm, type, ws, fh, $0| “/bin/nc -u 12201”

Notice how we have the field name with a leading underscore. For some reason this is being stripped out when it get to Graylog, The field displays as GL_environment instead of _GL_environment, Any idea why? All my other logs send the field name correctly.

how is your input setup? have you tried a RAW text input?

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.