Hi Oliver, extractors are only applied to new messages before they are indexed into Elasticsearch. Existing messages, which have already been indexed before, won't change if you change an extractor.
Cheers, Jochen On Thursday, 13 October 2016 11:34:03 UTC+2, Oliver Schrenk wrote: > > Hi, > > > I have a Syslog UDP input that takes in nginx log messages. I can see > that it works by making a search > > > http://host/search?q=gl2_source_input%3A57fe4c9b4e8722a5a56498eb&relative=28800 > > > <https://lh3.googleusercontent.com/-66DM9DFSjZ8/V_9Tk44yl7I/AAAAAAAAA9s/q4b_J_3rJwsbkcMcf00tu-Ujm0RpJZ1FgCLcB/s1600/results.png> > > > > > > > > > > > But when I configure a stream that matches one rule > > > <https://lh3.googleusercontent.com/-zhkDh0YN65U/V_9ToiV3PJI/AAAAAAAAA9w/iVrVrj0Sfvc3Iu0wXiCbWIIrGh6fHmAuwCLcB/s1600/stream.png> > > > > > > > > gl2_source_input must match exactly 57fe4c9b4e8722a5a56498eb > > > there are no results. > > > <https://lh3.googleusercontent.com/-N3XtsoVokKE/V_9Tv3HBs4I/AAAAAAAAA90/xqmuVN9oZsw5pXesnzHjYRclcTUToiiWwCLcB/s1600/no-results.png> > > > > > > > > But it works when I change it to a different Input id, from an older input > (GELF TCP > > How can I fix or debug this? > > Cheers, > Oliver > > > > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/61cce4ff-c631-4897-9c9b-ffb87a86475e%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
