JSON extractor and Cut mode

I’m using the Graylog 2.5 JSON extractor to expand a field in my logs. The extractor is configured for Cut mode but the original field is not being removed.

Do I understand the Cut mode correctly?

Found the same in issue 1564.

Reading around, it sounds like Extractors won’t be around much longer so this may be better done in a pipeline.

I took a look into the bug and add my thoughts.

Unfortunately we are in finishing up 3.0.0 and do not have the time for fixing it now.
But I add the milestone to 3.1.0 and hope I can do something then.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.