Graylog2 / Graylog2/graylog2-server
Allow removing field completely by Extractor
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## Expected Behavior
A cut-extractor should have the option to specify if the field should be removed from the message when the entire content of that field is removed by it.
## Current Behavior
Currently, when an extractor cuts a field completely, it places the placeholder text "fullyCutByExtractor" in the field. This field then has to be removed by a pipeline, since extractors cannot do that. There should be an option that, when cut mode is selected, let's the user choose wether to remove the field completely, leave it empty or fill it with the placeholder.
## Possible Solution
It has been quite a while since I looked into Graylog code, but I guess it should be relatively easy to implement a choice between put a placeholder or remove the field. Maybe it's just an if-statement and another entry in the extractor configuration definition... idk 😄
## Context
I have a small input that really is not worth a pipeline, but I ran into this (the first time in the last years tbh 😄 )
## Your Environment
* Graylog Version: 3.1.0
Contributor guide
Assessment
This issue has not been assessed yet.