New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Editing existing extractor, unable to specify test message id #1105

Closed
reighnman opened this Issue Feb 5, 2015 · 3 comments

Comments

Projects
None yet
4 participants
@reighnman

reighnman commented Feb 5, 2015

graylog2-web-interface v1.0.0-rc.2

When editing an extractor it loads a random message from the bound input to test against. When I created the extractor I used a full_message from a specific type of log as several sources use this input.

I should be able to load a message to test regex/grok against instead of it randomly selecting a message from the input. Or at least tie the edit extractor page to the main extractor page where you're able to load a message id when creating a new extractor.

@edmundoa edmundoa added the extractors label Feb 5, 2015

@edmundoa edmundoa added this to the 1.0.1 milestone Feb 5, 2015

@edmundoa

This comment has been minimized.

Member

edmundoa commented Feb 5, 2015

Thank you for reporting this. The manual loading makes complete sense and it's something we should add.

@runningman84

This comment has been minimized.

runningman84 commented Feb 13, 2015

A button to load another random message would help too. I would like to the my patterns against a bunch of message to make sure I catch all messages...

For eaxample my pattern looks like

(?:dstport|dst_port|destination-port|service)(?:=|:)"?(\d{1,6})"?

I would need at least four messages to verify that my pattern works for all of them.

@edmundoa edmundoa self-assigned this Mar 5, 2015

edmundoa added a commit that referenced this issue Mar 6, 2015

edmundoa added a commit that referenced this issue Mar 6, 2015

@kroepke

This comment has been minimized.

Contributor

kroepke commented Mar 10, 2015

fixed by merged pull request #1156 referenced above

@kroepke kroepke closed this Mar 10, 2015

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment