Graylog returning one thing in search and another in testing the extractor

Hi All,

Weird problem that I was hoping to get help with. When I search through my ASA messages I see that my extractor for the source field returns a number rather than a word. For example when testing the extractor on this message:

It returns WAN as the source

When looking at the message in my search, it returns 18

Any idea what I’ve got wrong here?

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.