# Parsing Logs On Graylog

**URL:** <https://community.graylog.org/t/parsing-logs-on-graylog/3043>\
**Category:** Graylog Central (peer support)\
**Created:** [November 3, 2017, 9:10am UTC](https://community.graylog.org/t/parsing-logs-on-graylog/3043 "2017-11-03T09:10:18Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![haywhai](https://avatars.discourse-cdn.com/v4/letter/h/bbe5ce/32.png) [@haywhai](https://community.graylog.org/u/haywhai)\
**Post date:** [November 3, 2017, 9:10am UTC](https://community.graylog.org/t/parsing-logs-on-graylog/3043/1 "2017-11-03T09:10:19Z")

</div>

Good day dear friends, please am new on graylog. I have been able to successfully forward logs to graylog. But i can only see the raw logs under “message”. Please how do i extract the fields i would like to see from the message. fields like source ip, destination ip, source and destination ports and all. Thanks

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [November 3, 2017, 9:33am UTC](https://community.graylog.org/t/parsing-logs-on-graylog/3043/2 "2017-11-03T09:33:07Z")

</div>

You can create custom extractors or pipeline rules to split the raw log message into the structured attributes you want to query:

- [http://docs.graylog.org/en/2.3/pages/extractors.html](http://docs.graylog.org/en/2.3/pages/extractors.html)
- [http://docs.graylog.org/en/2.3/pages/pipelines.html](http://docs.graylog.org/en/2.3/pages/pipelines.html)

---

<div class="post-metadata">

**Author:** ![haywhai](https://avatars.discourse-cdn.com/v4/letter/h/bbe5ce/32.png) [@haywhai](https://community.graylog.org/u/haywhai)\
**Post date:** [November 3, 2017, 9:35am UTC](https://community.graylog.org/t/parsing-logs-on-graylog/3043/3 "2017-11-03T09:35:23Z")

</div>

Thanks, i checked the documentation already. it worked for the test message. but i was expecting to see the field i created when i check System\>Inputs and click on a stream but it still didnt.

---

<div class="post-metadata">

**Author:** ![haywhai](https://avatars.discourse-cdn.com/v4/letter/h/bbe5ce/32.png) [@haywhai](https://community.graylog.org/u/haywhai)\
**Post date:** [November 3, 2017, 9:39am UTC](https://community.graylog.org/t/parsing-logs-on-graylog/3043/4 "2017-11-03T09:39:01Z")

</div>

Is there a way i can make the field global so i would be able to query it anywhere? Thanks

---

<div class="post-metadata">

**Author:** ![haywhai](https://avatars.discourse-cdn.com/v4/letter/h/bbe5ce/32.png) [@haywhai](https://community.graylog.org/u/haywhai)\
**Post date:** [November 3, 2017, 9:51am UTC](https://community.graylog.org/t/parsing-logs-on-graylog/3043/5 "2017-11-03T09:51:38Z")

</div>

Thanks guys, i got it fixed. I really appreciate.

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [November 3, 2017, 10:31am UTC](https://community.graylog.org/t/parsing-logs-on-graylog/3043/6 "2017-11-03T10:31:12Z")

</div>

Maybe you could describe what the issue was and how you’ve fixed it, so that other users can profit from your knowledge. 😉

---

<div class="post-metadata">

**Author:** ![haywhai](https://avatars.discourse-cdn.com/v4/letter/h/bbe5ce/32.png) [@haywhai](https://community.graylog.org/u/haywhai)\
**Post date:** [November 3, 2017, 10:48am UTC](https://community.graylog.org/t/parsing-logs-on-graylog/3043/7 "2017-11-03T10:48:36Z")

</div>

Okay i will; thanks.

---

<div class="post-metadata">

**Author:** ![haywhai](https://avatars.discourse-cdn.com/v4/letter/h/bbe5ce/32.png) [@haywhai](https://community.graylog.org/u/haywhai)\
**Post date:** [November 3, 2017, 10:58am UTC](https://community.graylog.org/t/parsing-logs-on-graylog/3043/8 "2017-11-03T10:58:33Z")

</div>

I made use of extractors…

1. Navigate to this System \> Inputs \> (Click on the Stream you want) \> Manage Extractors \> Create your own extractor.
2. I added this under the grok pattern: src=%{IP:Source} and i extracted it.
3. Went back to Start Input to refresh and see the changes made.
4. Then i showed the received messages and it worked perfectly fine.

I hope this works for you guys. I would keep working on others though-source and destination ports and all

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [November 17, 2017, 10:58am UTC](https://community.graylog.org/t/parsing-logs-on-graylog/3043/9 "2017-11-17T10:58:48Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.