Graylog2 / Graylog2/graylog2-server

json extractors not work with non-english field name

Open
#11,309 1 comment 0 reactions 0 assignees View on GitHub
bug processing triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

I have send some json message via raw udp input, each json message contain UTF-8 non-english field name like this:
![图片](https://user-images.githubusercontent.com/19371588/133948726-de93093a-691c-43ed-bb40-9c6640e77f21.png)
When I try json extractor with default config,seems work good as below:
![图片](https://user-images.githubusercontent.com/19371588/133948814-ce415c43-060f-445b-8e84-25ef404d0bcf.png)
So I add json extractor like this and also try passed.
Configuration

flatten:
list_separator: ,
kv_separator: =
key_prefix: j_
key_separator: _
replace_key_whitespace:
key_whitespace_replacement: _

## Expected Behavior

I can see some english field works with json extractor:
![图片](https://user-images.githubusercontent.com/19371588/133949093-92c2b498-2e12-4fa2-9313-ad290678317a.png)

But non-english field can not see:
![图片](https://user-images.githubusercontent.com/19371588/133949076-1cd70193-12b8-4255-adf5-58b0df7152de.png)

Here is my json message example:
{"source":"stream:icmp","sourcetype":"icmp","time":1632071413.6059999466,"endtime":"2021-09-19T17:10:13.606360Z","timestamp":"2021-09-19T17:10:13.606360Z","字节":135,"入向字节":135,"出向字节":0,"校验和":33039,"消息代码":0,"目标ip":"100.100.10.6","目标mac":"D2:AE:52:6C:52:47","标识符":2570,"详细协议":"ip:icmp","序列号":2631,"源ip":"100.10.10.12","源mac":"01:50:56:9A:F3:D9","总用时":0,"消息类型":5,"类型说明":"Redirect"}

Thank you for your help

* Graylog Version: Graylog v4.1.5+01c9198
* Java Version: openjdk version "1.8.0_292"
* Elasticsearch Version:7.10.1
* MongoDB Version: MongoDB shell version v4.0.27
* Operating System: ubuntu 20.04
* Browser version: Firefox 92.0

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.