Graylog2 / Graylog2/graylog2-server

Pipeline Rule creation should be like extractor rule creation

Open
#5,895 0 comments 0 reactions 0 assignees View on GitHub
feature processing triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Using the pipeline rule model (and no input extractors) I have started using the following workflow to create grok patterns/parsers:
1. Find an improperly parsed message in index, use dropdown to 'create extractor'.
2. Use the extractor rule creation to generate a parse pattern against the sample message.
3. Copy the resulting pattern, close the extractor creation without saving
4. Create pipeline parse rule and include pattern to use against messages

## Expected Behavior
It would be nice if there were a similar workflow to create pipeline rules as there are for extractors.
Maybe I'm missing something and there's currently a better way to do things? I have been avoiding input extractors and doing everything inside a pipeline in 3.x.

## Possible Solution
In the extractor creation, "elevate" the created extractor to a pipeline rule to attach to pipelines.

* Graylog Version: 3.0.1

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.