You need to create an extractor for each field, provided you know fields names, then you can extract a value with regex, like `fieldname=([^&]*)`
W dniu wtorek, 23 czerwca 2015 14:39:46 UTC+2 użytkownik David Gerdeman napisał: > > In the uri-query field of my IIS logs I have a website that generates > values for this field that is key=value pairs delimited by "&". Sometimes > this field might have one or two key=value pairs, and sometimes it has as > many as six or seven. I would like to extract those key=value pairs and > bring them into graylog as separate fields, but haven't had much luck. Is > there a good way to extract these fields? > -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
