How to mass delete duplicate GROK patterns?

Graylog Central (peer support)
1

Not sure why but all my GROK patterns show twice. Its entirely possible I imported the same set twice. I can see a delete button to the right of each pattern but that would take me hours, is there a quick way?

2

You can drop the “grok_patterns” collection in MongoDB and re-import your patterns.

FWIW, if there really are duplicate Grok patterns, this is a bug. In this case please create a bug report at https://github.com/Graylog2/graylog2-server/issues.

3

I’m 99% sure I caused this by applying the content pack twice as there is no way to see if this has already happened or not. Also, this is simply a cosmetical / OCD issue for me and in no way impacts the way Graylog is working for me.

image
image.png1111×454 49.2 KB

4

Couldn’t add 2 images in one post.

image
image.png1564×1013 169 KB

5

Hello,
I have exactly the same issue: https://community.graylog.org/t/grok-patterns-defined-twice/3162
I am sure I have never clicked on Apply Content Pack.
I think in my case duplicate entries came from the Graylog update.

6

I saw your thread but it was closed so I opened my own :slight_smile: