Using Extractors without inputs

Hi there,
I’m a new one on this forum and I think it is a fantastic community.

I have a question for you and I hope someone can help me.
I have a Graylog node just used as repository, so no inputs are configured. I just imported some elasticsearch indices from an other cluster to mine, in this way I can search messages directly from indexes making queries on Search tab. Now, I would like to use extractors on this messages, but I can’t, since I have no inputs running.

Is there a way to use them without any inputs configured?

Any help is appreciated.

Many thanks!

I don’t believe this is possible as the messages are already stored in Elasticsearch.

You would need to utilise the GROK on either an Input or within a Pipeline.
Once the message reaches Elasticsearch, Graylog has finished its processing of the message.

Perfect, so there’s no way to make it work :slight_smile:

Thanks for your reply.

Graylog (ELK and others) do the processing only on INGEST, that is why you can’t do it after the messages are written to Elasticsearch.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.