Graylog2 / Graylog2/graylog2-server

Extractor preview doesn't validate field names

Open
#2,466 0 comments 0 reactions 0 assignees View on GitHub
improvement processing
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

### Problem description

When you create an extractor, it will preview the fields that are being extracted when you try the grok pattern. This should in theory then show what fields will be created.

Say that you define following grok pattern: %{NUMBER:bytes:int}

Yes, it's bad syntax, since the last : should be a ;. But what you'll observe in the extractor preview, is that it claims to create a field called "bytes:int". If you then actually go and index data with this, there'll be no index called "bytes", or "bytes:int". It will however create a non-int field called "BASENUM10".

This is rather confusing. I believe the extractor test/preview should point out that you can't have a colon, as an example, in the field name, and you probably meant to use a semi-colon.
### Steps to reproduce the problem
1. Create an extractor with this grok pattern: %{NUMBER:bytes:int}
2. Preview the extractor with some data that's just an integer. Note that it shows "byte:int" as being an extracted field, and no error
3. Now send more data at this input
4. Observe that no field is created called "bytes", or "bytes:int", and no error is thrown

Excepted behaviour would be that in step 2, that it raises an error due to the extracted field not being a valid field name to index, due to the colon.
### Environment
- Graylog Version: 2.0.3 OVA

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.