Parse works, field extraction doesn't

Comments

2 comments

  • Avatar
    Michael Floyd
    Hi Brian, try posting in the Slack channel (link is in the top nav above).
  • Avatar
    Mario Sanchez
    Hey Brian, Your parse rule seems to be created correctly. Here's 2 things I can comment/suggest: -- Parse rules only act on new data being ingested, as the parsing happens at the time of ingestion (unlike parsing in the query which can parse previously ingested data), so if you wait for new data to ingest, you should see those parse fields. -- If not all log messages have wifi_Username, wifi_MACaddress and/or wifi_IPaddress, you should add the nodrop option to your parse statements so that those that do exist in the message do not get dropped. Hope this helps! Cheers, Mario

Please sign in to leave a comment.