Skip to content
This repository has been archived by the owner. It is now read-only.

Editing existing extractor, unable to specify test message id #1105

Closed
reighnman opened this issue Feb 5, 2015 · 3 comments
Closed

Editing existing extractor, unable to specify test message id #1105

reighnman opened this issue Feb 5, 2015 · 3 comments
Assignees
Milestone

Comments

@reighnman
Copy link

@reighnman reighnman commented Feb 5, 2015

graylog2-web-interface v1.0.0-rc.2

When editing an extractor it loads a random message from the bound input to test against. When I created the extractor I used a full_message from a specific type of log as several sources use this input.

I should be able to load a message to test regex/grok against instead of it randomly selecting a message from the input. Or at least tie the edit extractor page to the main extractor page where you're able to load a message id when creating a new extractor.

@edmundoa edmundoa added this to the 1.0.1 milestone Feb 5, 2015
@edmundoa
Copy link
Member

@edmundoa edmundoa commented Feb 5, 2015

Thank you for reporting this. The manual loading makes complete sense and it's something we should add.

Loading

@runningman84
Copy link

@runningman84 runningman84 commented Feb 13, 2015

A button to load another random message would help too. I would like to the my patterns against a bunch of message to make sure I catch all messages...

For eaxample my pattern looks like

(?:dstport|dst_port|destination-port|service)(?:=|:)"?(\d{1,6})"?

I would need at least four messages to verify that my pattern works for all of them.

Loading

@edmundoa edmundoa self-assigned this Mar 5, 2015
edmundoa added a commit that referenced this issue Mar 6, 2015
edmundoa added a commit that referenced this issue Mar 6, 2015
@kroepke
Copy link
Contributor

@kroepke kroepke commented Mar 10, 2015

fixed by merged pull request #1156 referenced above

Loading

@kroepke kroepke closed this Mar 10, 2015
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
4 participants