Using Extractors without inputs

Graylog Central (peer support)
1

Hi there,
I’m a new one on this forum and I think it is a fantastic community.

I have a question for you and I hope someone can help me.
I have a Graylog node just used as repository, so no inputs are configured. I just imported some elasticsearch indices from an other cluster to mine, in this way I can search messages directly from indexes making queries on Search tab. Now, I would like to use extractors on this messages, but I can’t, since I have no inputs running.

Is there a way to use them without any inputs configured?

Any help is appreciated.

Many thanks!

2

I don’t believe this is possible as the messages are already stored in Elasticsearch.

You would need to utilise the GROK on either an Input or within a Pipeline.
Once the message reaches Elasticsearch, Graylog has finished its processing of the message.

3

Perfect, so there’s no way to make it work :slight_smile:

Thanks for your reply.

4

Graylog (ELK and others) do the processing only on INGEST, that is why you can’t do it after the messages are written to Elasticsearch.