Hi Joshua, you can use a JSON extractor for expanding the message field.
Seeing that it's a Java application, I'd recommend using one of the many existing GELF appenders for Java logging frameworks on the Graylog Marketplace <https://marketplace.graylog.org/addons?search=java> to let your applications log directly into Graylog. That way, the information is already structured and doesn't need to be post-processed by Graylog. Cheers, Jochen On Thursday, 28 July 2016 22:39:51 UTC+2, Joshua Walderbach wrote: > > Thank you! I added the ShortMessageLength 256 to my extension bracket and > that allowed the full raw message. Now I want to tell it to take this: > > {"datetime":"2016-07-28T20:37:00.0143129Z","level":"Debug","name":"Quartz.Core.QuartzSchedulerThread","message":"Batch > > acquisition of 1 triggers", "requesterIp":"","threadid":"18"} > > dateTime: xxxx > level: Debug > name: xxxx > message: xxxxx > requesterIp: xxxxx > threadid: xxxx > > Instead of the entire above string listed under "message". > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/cc2247a1-fb6c-4352-aea8-1d1cf93e2603%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
