Hi Matthew, On Friday, 10 February 2017 00:51:57 UTC+1, Matthew Shapiro wrote: > > Does Graylog have any detection of duplicate messages to overwrite, and if > not is there any way to force an id on a message via an extractor? >
No, Graylog doesn't support de-duplication of messages and overwriting the internal _id field is forbidden, so I'm afraid you'll have to delete the old messages manually from Elasticsearch using some other attributes. Cheers, Jochen -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/ce50e0c2-9acb-4217-8514-7c7ecff05ddf%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
