Hi Daniel, The regex condition you use will always try to extract the 4th split element, if there is a number in the whole message field, as it's the one you use for the extractor. I guess some of your messages contain numbers, but not in the place you want them to be. If that is the case, I would start by trying to find a better patter to differentiate between both messages.
Regards, Edmundo > On 29 Mar 2016, at 23:32, Daniel Niasoff <[email protected]> wrote: > > Hi > > I have an extractor that tried to extract a numeric field from a message. > > I am using split and index and field content can sometimes contain a "-" > instead of a number. > > I have a regex pattern that checks for valid numerals - "\d+" > > But Graylog still extracts the field even if it just contains a "-" which > messes up statistics. > > Here is the config of the extractor. > > > { > "condition_type": "regex", > "condition_value": "\d+", > "converters": [ > { > "type": "numeric", > "config": {} > } > ], > "cursor_strategy": "copy", > "extractor_config": { > "index": 4, > "split_by": " ' %1B ' " > }, > "extractor_type": "split_and_index", > "order": 3, > "source_field": "message", > "target_field": "Client-Time-Taken", > "title": "Client-Time-Taken" > }, > > Any ideas? > > Thanks > > Daniel > > -- > You received this message because you are subscribed to the Google Groups > "Graylog Users" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion on the web visit > https://groups.google.com/d/msgid/graylog2/c55d782d-3ead-4af4-b645-01cca05069a5%40googlegroups.com. > For more options, visit https://groups.google.com/d/optout. -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/6C4C6D01-7AD2-496B-AAFE-960F03E95AB7%40graylog.com. For more options, visit https://groups.google.com/d/optout.
