Graylog2 / Graylog2/graylog2-server
Pipeline Rule creation should be like extractor rule creation
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
Using the pipeline rule model (and no input extractors) I have started using the following workflow to create grok patterns/parsers:
1. Find an improperly parsed message in index, use dropdown to 'create extractor'.
2. Use the extractor rule creation to generate a parse pattern against the sample message.
3. Copy the resulting pattern, close the extractor creation without saving
4. Create pipeline parse rule and include pattern to use against messages
## Expected Behavior
It would be nice if there were a similar workflow to create pipeline rules as there are for extractors.
Maybe I'm missing something and there's currently a better way to do things? I have been avoiding input extractors and doing everything inside a pipeline in 3.x.
## Possible Solution
In the extractor creation, "elevate" the created extractor to a pipeline rule to attach to pipelines.
* Graylog Version: 3.0.1
Contributor guide
Assessment
This issue has not been assessed yet.