Hi Trey, One way you can do this is by search and replace queries or otherwise directly to elasticsearch. I have little experience it, but it can be done. There is the possibility of batch processing it.
https://www.elastic.co/guide/en/elasticsearch/reference/current/_introducing_the_query_language.html Op vrijdag 12 juni 2015 22:57:11 UTC+2 schreef Trey Dockendorf: > > I am very new to Graylog, and am really enjoying the experience so far. > Currently I'm on 1.0.2 since the Puppet module doesn't seem to yet support > 1.1.x. In testing the extractors I've found that messages received after > an extractor is added do not get the fields created. Is there a way to go > back and have graylog re-index or apply extractor updates? My goal is to > get all the raw data into Graylog now and adapt the extractors and streams > as I gain more experience. However if I can't update existing messages > then the "old" log data becomes harder to use. Is there an existing way to > update old messages? > > Thanks, > - Trey > -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
