On Friday, January 6, 2017 at 6:33:17 AM UTC-6, Frank wrote: > > <snip> > Plain shows the message without the fields that should be removed, but > also without the added custom fields. > Full and structured show the message with the custom fields, but also with > all fields that should be removed. > > Not sure I understand the question but I wasn't able to get my custom fields to show up in any searches unless I put all my pipelines on the "Default Stream" under System/Pipelines > Pipelines (Default Stream) > Add new Connection/ Edit Connections. This doesn't seem to be the way I understood things to work but it's working. Maybe it's because I have one syslog listener on my graylog server with multiple machines logging to it don't know. Hope it helps.
-- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/77e70f10-6449-4623-8839-a62371737715%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
