I would like to know how can I search for log messages with a custom properties containing a field named “Main Status” and value “Starting Process”…
how can i do that?
Is the “main status” field being extracted? i.e. is there a dedicated field or it or is it within the bulk “message field”?
Did you read the Documentation on that?
http://docs.graylog.org/en/2.4/pages/queries.html
is something not clear on that?
Jan, instead of being a dick about it, why don’t you point something friendly, like “why dont you try this query? for more info about it, check documentation’s section X”
Its a dedicated field. It’s content is a JSON… i thought it was kinda default field on the platform… I’m used to Application Insights, and on it the query would go something like where CustomProperties.SubField = Value
Leonardo if you have performed extractions against the logs to ensure dedicated fields were created for that log type as needed (http://docs.graylog.org/en/2.4/pages/extractors.html) then you can run a search in this format Main Status:Starting Process . That requires Main Status to be it’s own field in graylog though (not just in the raw log that came in.
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.