Filter messages by field position delimited by whitespasce? (like: cut -d" " -f...)

Graylog Central (peer support)
1

Hi, i have some services which sends whole messages into Graylog and they are not parsed (yet) but have a defined layout so the first parts could be split by whitespace. Is there a way to write a query which acts only on a specific field of that message.

2024-12-04 08:20:30,813 - INFO  - eventfilter.EventFilter - [d09cf8a8-4ba7-4585-b54d-90082df6c262] - Content item filtered out (id: 36383035, content-type: 'picture')

Here i’d like to get the 4th (severity), 6th (type) and 10th onwards into a search query.

2

Hey @igittigitt

I assume you want parts of the message and place them under a custom field? you could try a pipeline /w regex.

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.