Possible duplicate
of https://github.com/Graylog2/graylog2-server/issues/2742 ?
On Monday, August 29, 2016 at 11:30:28 AM UTC+12, Werner van der Merwe
wrote:
>
> Hi,
>
> It seems that if I create an extractor, I have to create an extractor for
> each field I want to store, is this correct?
>
> If so, what would be helpful (for me), and what I am using NXLog for at
> the moment, is to have to option to extract and store multiple regex groups
> in one extracter.
>
> For example being able to do this using a single extractor entry rather
> than creating multiples:
>
> Exec if $raw_event =~ /^(\S+) (\S+) (\S+) \[([^\]]+)\] \"(\S+) (.+)
> HTTP.\d\.\d\" (\d+) (\d+) \"([^\"]+)\" \"([^\"]+)\"/\
> { \
> $Hostname = $1; \
> if $3 != '-' $AccountName = $3; \
> $EventTime = parsedate($4); \
> $HTTPMethod = $5; \
> $HTTPURL = $6; \
> $HTTPResponseStatus = $7; \
> $FileSize = $8; \
> $HTTPReferer = $9; \
> $HTTPUserAgent = $10; \
> }
>
> Is this possible, or would it be possible at some point in the future?
>
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/e9da3e6b-7ca1-438b-ae94-0db9b6c4a1af%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
