At my organization, we created extractors using Grok patterns in our Graylog instance to parse our logs into fields.
I’ve been noticing in Graylog if an extractor doesn’t successfully parse a log (because the format doesn’t match the Grok pattern) the log doesn’t get written to an index. Instead, it generates an indexing failure.
This means that if a log format changes we’ll lose all our logs until we update our extractors.
Is there a way to avoid this?