Hi! The GELF spec says to prefix additional fields with an underscore, http://graylog2.org/gelf#specs, yes. When searching you simply omit the underscore, they are simply an artifact of the transport mechanism during sending. The graylog2 server removes the underscore when storing the message what gives you the idea that the underscore is stored?
Best, Kay On Friday, January 24, 2014 9:43:45 AM UTC+1, Rahman Duran wrote: > > Hi, > > New 0.20.x does now store extracted fields with an underscore (_). So what > is the status of gelf input additional fields? Does it still uses "_" for > additional fileds? If yes then how does 0.20.x handle the searches? Do we > need to search with underscore or not? > -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
