Hi! Sorry for the dumb questions but: How does an extractor exactly work, I mean software side. Does it store those extracted fields in elasticsearch working something like a mapping? Or the “extraction patterns” are completely stored Graylog-side and every time we query something from Elastic it …

I do believe it’s the first option: Data comes in to Graylog Data moves through extractors and pipelines, depending on config. Data is permutated based on rules in extractors and pipelines. All resulting data is stored in ElasticSearch. And yes, I do believe that extractors can affect performance…

Questions regarding Extractor

Graylog Central (peer support)

macko003 January 24, 2019, 10:48am 5

You need some CPU in GL servers, and some disk in ES servers to do it.
Try it, if you don’t do big mistakes wont be any problem.

1 Like

Topic		Replies	Views
Extractor before adding to Elasticsearch? Graylog Central (peer support)	1	311	December 31, 2020
Searching on extracted fields Graylog Central (peer support)	3	526	October 4, 2019
Deleted Extractor Still Running Graylog Central (peer support)	5	778	May 13, 2019
Graylog CPU spiked to 500% and ES seems slow Graylog Central (peer support)	6	1323	March 18, 2019
Exctractors Check Graylog Central (peer support)	4	1341	September 13, 2018

Questions regarding Extractor

Related topics