Hi,
It seems that if I create an extractor, I have to create an extractor for
each field I want to store, is this correct?
If so, what would be helpful (for me), and what I am using NXLog for at the
moment, is to have to option to extract and store multiple regex groups in
one extracter.
For example being able to do this using a single extractor entry rather
than creating multiples:
Exec if $raw_event =~ /^(\S+) (\S+) (\S+) \[([^\]]+)\] \"(\S+) (.+)
HTTP.\d\.\d\" (\d+) (\d+) \"([^\"]+)\" \"([^\"]+)\"/\
{ \
$Hostname = $1; \
if $3 != '-' $AccountName = $3; \
$EventTime = parsedate($4); \
$HTTPMethod = $5; \
$HTTPURL = $6; \
$HTTPResponseStatus = $7; \
$FileSize = $8; \
$HTTPReferer = $9; \
$HTTPUserAgent = $10; \
}
Is this possible, or would it be possible at some point in the future?
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/1d9d7d63-157f-4d97-aa71-59d8371731d9%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
