Using extractor to create a field that gets displayed with newlines

Graylog Central (peer support)
1

In my installation, I receive a number of very long messages that I’d like to render (in the /search
and message views) in multiple lines. I would prefer not to have to fix this from the source side due to the fact that there are many different sources and a chain of log forwarders between them.

Is it possible to add a newline to a field using an extractor? I’ve tried inserting \n, \n,
but it seems they get escaped somewhere along the line, because it doesn’t show up when viewing the message.

2

I’m not married to an extractor, by the way – if there’s a way to do this with a drools rule (as per https://serverfault.com/questions/666161/how-to-replace-control-characters-in-rsyslog) or with a pipeline, I’m open to it.

3

For reference, I posted this to stackoverflow: https://serverfault.com/questions/666161/how-to-replace-control-characters-in-rsyslog

4

currently this is not possible - but we have this feature request for that: https://github.com/Graylog2/graylog2-server/issues/5225

5

Thanks. Could you point me to the code where this is handled? I could take a stab at implementing it.

In the meantime, for others trying to work around this limitation, here’s some bookmarklet code which can be used to convert “#012” (which rsyslog encodes newlines into) to newlines in messages in the search and message views:

javascript:(function(){for (var e of document.getElementsByClassName("field-value")) { e.textContent = e.textContent.replace(/#012/g, "\n"); };})();

Is there a way to add custom JS to the Graylog views? That would be another way of working around the issue without needing to use a bookmarklet.

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.