Graylog2 / Graylog2/graylog2-server

Add possibility for extractor to execute when another column/field is matched

Open
#8,129 0 comments 1 reaction 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## What?
When you create an extractor, you can today choose a *Condition* when it's supposed to execute as such;
`Always try to extract`
`Only attempt extraction if field contains string`
`Only attempt extraction if field matches regular expression`

I would like a fourth option `Only attempt extraction if another field contains string`

## Why?
Usually you create an extractor for the message field, but there isn't always a unique string in the message field you can match. This leads to the extractor executing when not needed.

If there was a possibility to create an extractor for one field, and then specify a condition for another field we would be able to nail down the extractor to the proper execution time.

For example;
Create a extractor for the `message` field, then specify that its only allowed to execute if field `log_path` contains `-error.log` (or similar situations such as matching on node/hostname)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.