# Replace in extractor

**URL:** <https://community.graylog.org/t/replace-in-extractor/3199>\
**Category:** Graylog Central (peer support)\
**Created:** [November 16, 2017, 8:23pm UTC](https://community.graylog.org/t/replace-in-extractor/3199 "2017-11-16T20:23:35Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![d-malko](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/d-malko/32/1143_2.png) [@d-malko](https://community.graylog.org/u/d-malko)\
**Post date:** [November 16, 2017, 8:23pm UTC](https://community.graylog.org/t/replace-in-extractor/3199/1 "2017-11-16T20:23:35Z")

</div>

Hello! Can you advice? Can I use extractor to find some value and when this value exist store to the field some othe value. Example: If value snmp exist in message, store in field true. To get finally -\> (SNMP\_FIELD: true)  
I will be very grateful for your help!

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [November 16, 2017, 10:33pm UTC](https://community.graylog.org/t/replace-in-extractor/3199/2 "2017-11-16T22:33:12Z")

</div>

You can use the processing pipeline for that: [http://docs.graylog.org/en/2.3/pages/pipelines.html](http://docs.graylog.org/en/2.3/pages/pipelines.html)

---

<div class="post-metadata">

**Author:** ![d-malko](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/d-malko/32/1143_2.png) [@d-malko](https://community.graylog.org/u/d-malko)\
**Post date:** [November 17, 2017, 11:34am UTC](https://community.graylog.org/t/replace-in-extractor/3199/3 "2017-11-17T11:34:12Z")

</div>

Thank you! Exactly what is needed.  
Can I use pipeline after extractor?  
Example:

1. Extractor adding new field SNMP
2. Add pipeline:  
rule "test"  
when  
has\_field(“SNMP”)  
then  
set\_field(“SNMP”, “true”);  
end

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [November 17, 2017, 11:44am UTC](https://community.graylog.org/t/replace-in-extractor/3199/4 "2017-11-17T11:44:04Z")

</div>

> [@d-malko](#):
>
> Can I use pipeline after extractor?

Yes, depending on what the order of message processors is. See System/Configurations in the Graylog web interface.

---

<div class="post-metadata">

**Author:** ![d-malko](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/d-malko/32/1143_2.png) [@d-malko](https://community.graylog.org/u/d-malko)\
**Post date:** [November 20, 2017, 8:30am UTC](https://community.graylog.org/t/replace-in-extractor/3199/5 "2017-11-20T08:30:57Z")

</div>

I am grateful to you for your help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [December 4, 2017, 8:31am UTC](https://community.graylog.org/t/replace-in-extractor/3199/6 "2017-12-04T08:31:03Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.