How to search by custom field property


(Leonardo) #1

I would like to know how can I search for log messages with a custom properties containing a field named “Main Status” and value “Starting Process”…

how can i do that?


(Megan) #2

Is the “main status” field being extracted? i.e. is there a dedicated field or it or is it within the bulk “message field”?


(Jan Doberstein) #3

Did you read the Documentation on that?

http://docs.graylog.org/en/2.4/pages/queries.html

is something not clear on that?


(Leonardo) #4

Jan, instead of being a dick about it, why don’t you point something friendly, like “why dont you try this query? for more info about it, check documentation’s section X”


(Leonardo) #5

Its a dedicated field. It’s content is a JSON… i thought it was kinda default field on the platform… I’m used to Application Insights, and on it the query would go something like where CustomProperties.SubField = Value


(Megan) #6

Leonardo if you have performed extractions against the logs to ensure dedicated fields were created for that log type as needed (http://docs.graylog.org/en/2.4/pages/extractors.html) then you can run a search in this format Main Status:Starting Process . That requires Main Status to be it’s own field in graylog though (not just in the raw log that came in.


(system) #7

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.