On Friday, January 6, 2017 at 6:33:17 AM UTC-6, Frank wrote: > > <snip> > Plain shows the message without the fields that should be removed, but > also without the added custom fields. > Full and structured show the message with the custom fields, but also with > all fields that should be removed. > > Not sure I understand the question but I wasn't able to get my custom fields to show up in any searches unless I put all my pipelines on the "Default Stream" under System/Pipelines > Pipelines (Default Stream) > Add new Connection/ Edit Connections. This doesn't seem to be the way I understood things to work but it's working. Maybe it's because I have one syslog listener on my graylog server with multiple machines logging to it don't know. Hope it helps.
-- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/77e70f10-6449-4623-8839-a62371737715%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
