Graylog2 / Graylog2/graylog2-server
Add possibility for extractor to execute when another column/field is matched
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## What?
When you create an extractor, you can today choose a *Condition* when it's supposed to execute as such;
`Always try to extract`
`Only attempt extraction if field contains string`
`Only attempt extraction if field matches regular expression`
I would like a fourth option `Only attempt extraction if another field contains string`
## Why?
Usually you create an extractor for the message field, but there isn't always a unique string in the message field you can match. This leads to the extractor executing when not needed.
If there was a possibility to create an extractor for one field, and then specify a condition for another field we would be able to nail down the extractor to the proper execution time.
For example;
Create a extractor for the `message` field, then specify that its only allowed to execute if field `log_path` contains `-error.log` (or similar situations such as matching on node/hostname)
Contributor guide
Assessment
This issue has not been assessed yet.