How to mass delete duplicate GROK patterns?


#1

Not sure why but all my GROK patterns show twice. Its entirely possible I imported the same set twice. I can see a delete button to the right of each pattern but that would take me hours, is there a quick way?


How to mass delete duplicate GROK patterns
(Jochen) #2

You can drop the “grok_patterns” collection in MongoDB and re-import your patterns.

FWIW, if there really are duplicate Grok patterns, this is a bug. In this case please create a bug report at https://github.com/Graylog2/graylog2-server/issues.


#3

I’m 99% sure I caused this by applying the content pack twice as there is no way to see if this has already happened or not. Also, this is simply a cosmetical / OCD issue for me and in no way impacts the way Graylog is working for me.


#4

Couldn’t add 2 images in one post.


#5

Hello,
I have exactly the same issue: https://community.graylog.org/t/grok-patterns-defined-twice/3162
I am sure I have never clicked on Apply Content Pack.
I think in my case duplicate entries came from the Graylog update.


#6

I saw your thread but it was closed so I opened my own :slight_smile:


(system) #7

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.