Graylog returning one thing in search and another in testing the extractor

(charlie) #1

Hi All,

Weird problem that I was hoping to get help with. When I search through my ASA messages I see that my extractor for the source field returns a number rather than a word. For example when testing the extractor on this message:

It returns WAN as the source

When looking at the message in my search, it returns 18

Any idea what I’ve got wrong here?