Multiple Fields extractor regex

Graylog Central (peer support)
1

I’m rather new to graylog, was trying to find solution, but I guess I don’t have the search powers just yet…

We use graylog for application logs, lines such as :

2018-01-04 19:31:15,759 INFO [service_name.convert_to_xls] [task_id=4f96611e-6ddc-48c6-822a-45980eda60cc] [account_id=moshe] [applicant_type=application] [applicant_id=OO1234] starting excel pdf update file_name=margarina.xls

What I want is to add an extrator such that each “[key=value]” will turn into a search able field:
so:
task_id:‘4f96611e-6ddc-48c6-822a-45980eda60cc’
and:
account_id:‘moshe’

I could create an extractor for each case, but since we have few of these (and some may be added) I was thinking maybe there is a more generic solution here, via pipeline, but reading the docs I was unable to figure this out :frowning:

Would appreciate any help or pointers here.

2

With the processing Pipelines you could write such a rule.

See for reference the test inside the code and look at the documentation.

Just one Idea how you could solve that.

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.