Hi Matthew, On Friday, 10 February 2017 00:51:57 UTC+1, Matthew Shapiro wrote: > > Does Graylog have any detection of duplicate messages to overwrite, and if > not is there any way to force an id on a message via an extractor? >
No, Graylog doesn't support de-duplication of messages and overwriting the internal _id field is forbidden, so I'm afraid you'll have to delete the old messages manually from Elasticsearch using some other attributes. Cheers, Jochen -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/ce50e0c2-9acb-4217-8514-7c7ecff05ddf%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
