[graylog2] Re: how to resolve issue with indexer

Thank you! Resolved with renaming level to log_level in logstash configuration rename => [ "level" , "log_level" ] Regards, Jiri On Thursday, February 16, 2017 at 10:02:37 AM UTC+1, Jochen Schalanda wrote: > > Hi Jiří, > > the "level" message field has to be a numeric value, i. e. the numeric

[graylog2] Re: how to resolve issue with indexer

Hi Jiří, the "level" message field has to be a numeric value, i. e. the numeric severity level of syslog messages: https://en.wikipedia.org/wiki/Syslog#Severity_level You can use message processor pipeline rules to change that in Graylog: http://docs.graylog.org/en/2.2/pages/pipelines.html