Multiple Fields extractor regex

I’m rather new to graylog, was trying to find solution, but I guess I don’t have the search powers just yet…

We use graylog for application logs, lines such as :

2018-01-04 19:31:15,759 INFO [service_name.convert_to_xls] [task_id=4f96611e-6ddc-48c6-822a-45980eda60cc] [account_id=moshe] [applicant_type=application] [applicant_id=OO1234] starting excel pdf update file_name=margarina.xls

What I want is to add an extrator such that each “[key=value]” will turn into a search able field:

I could create an extractor for each case, but since we have few of these (and some may be added) I was thinking maybe there is a more generic solution here, via pipeline, but reading the docs I was unable to figure this out :frowning:

Would appreciate any help or pointers here.

With the processing Pipelines you could write such a rule.

See for reference the test inside the code and look at the documentation.

Just one Idea how you could solve that.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.