Indexer failures and regex with set_field in Pipeline 2

[jan (Jan Doberstein)]

he @sequento

the function has some parameters that allow to work with that:

Can we use Elasticsearch false or strict with Graylog?

Otherwise it’s in some cases interpreting anything around an ‘=’ sign, even if there is no space delimiter, as a key=value pair and extracting it? The extractor does exactly that - So the extractor key-value is not that powerful. The processing pipeline key-value function can be configured more deeply: key_value(value: to_string(message), trim_value_chars: "\"", trim_key_chars:"\"", delimiters:" ", kv_delimiters:"="); This would prefend the = in the value is used to separate a new value fro…

That might already help you in this situation. I’m also sorry that I wasn’t clear in my message before that I aim for the processing pipelines …