Questions regarding Extractor

Graylog Central (peer support)
2

I do believe it’s the first option:

  1. Data comes in to Graylog
  2. Data moves through extractors and pipelines, depending on config.
  3. Data is permutated based on rules in extractors and pipelines.
  4. All resulting data is stored in ElasticSearch.

And yes, I do believe that extractors can affect performance. Especially if you’re working with regular expressions with wildcards in inconvenient places. But the actual performance hit I can’t tell you much about. I do believe @macko003 knows a lot about this.

1 Like