Removing JSON fields based on patterns

Graylog Central (peer support)
1

I have a json extractor running and extracting all sorts of fields. Problem is it is doing too good of a job and I hit the 1000 fields error. Is there a way to remove fields based on pattern matches of the fieldname to reduce the amount of fields?

2

No, but you can remove specific fields in a pipeline rule with the remove_field() function.

3

I could do that if I knew what the fields were. If I could iterate the fields to make decisions via pattern matching to keep or remove; but, there doesn’t seem to be anything like that.

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.