Graylog Collector--Preserving YAML key order

Is there a way to preserve the key order of the items in ‘Event name’? For example, If I put in the following in the Event Name field:


It outputs like this:

  • drop_event.when.and: null
    equals.event_id: “4688”
    equals.log_name: Security
    not.or: null
    processors: null

Any ideas? I am loving Graylog but the collector has been the most fickle thing I’ve ever used.

Edit: Is this something I need to use a Snippet to accomplish?

the Version 3.0 will have multiple improvements for the sidecar that will make your request possible.

Currently, I’m not sure if this is a filebeat issue (I assume you use filebeat as a collector with the sidecar) or not.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.