Running key=value tokenizer extractor from Pipelines (now possible in v4.3)

Graylog Central (peer support)
1

Graylog v4.3+ has updated the key_value function to perform basic handling of quotes!
You’ll still need a regex for handling escapes like \" in front of it, but it will (finally) get the job done!
See Upgrading to Graylog 4.3.x - Upgrading Graylog - Behaviour Changes for details.

This solves Running key=value tokenizer extractor from Pipelines?, Extracting key="some value" in pipelines and Key_value in pipelines vs key_value on "input extractors"

4 Likes
2

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.