Graylog Collector--Preserving YAML key order


(bluescreenofwin) #1

Is there a way to preserve the key order of the items in ‘Event name’? For example, If I put in the following in the Event Name field:

[{‘processors’:,‘drop_event.when.and’:,‘equals.log_name’:‘Security’,‘not.or’:,‘equals.event_id’:‘4771’,‘equals.event_id’:‘4688’}]

It outputs like this:

  • drop_event.when.and: null
    equals.event_id: “4688”
    equals.log_name: Security
    not.or: null
    processors: null

Any ideas? I am loving Graylog but the collector has been the most fickle thing I’ve ever used.

Edit: Is this something I need to use a Snippet to accomplish?


(Jan Doberstein) #2

the Version 3.0 will have multiple improvements for the sidecar that will make your request possible.

Currently, I’m not sure if this is a filebeat issue (I assume you use filebeat as a collector with the sidecar) or not.


(system) #3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.