Graylog2 / Graylog2/graylog2-server

JSON extractor ignore keys with space or other non-alpha num characters

Open
#2,630 9 comments 0 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

The JSON extractor can't deal with special characters, including space, in the key. The preview of the extractor will work, but it will doesn't actually work on the messages.
Graylog version : 2.0.3.
## Expected Behavior

The expected behavior is that the JSON extractor can deal with everything described in the json standard.

## Current Behavior

The fields that contains non-aplha(num?) character are ignored when the actual extracting occurs (the preview is ok).

## Steps to Reproduce (for bugs)

1. Setup a raw tcp input, let's say 127.0.0.1:1600
2. Send a regular json message in it with a strict alphanum key :
echo '{ "testdecode":"test ok" }' | nc 0 1600
3. In Graylog, setup a JSON extractor on the message field, without flatening. Send the same message again and verify : it should be parsed as expected.
4. Now, introduce some spaces in the same message :
echo '{ "test de code":"test ok" }' | nc 0 1600
5. Verify in Graylog : the message appears in Graylog but seems unparsed.
6. Now, put both fields :
echo '{ "testdecode":"test ok", "test de code":"test ok" }' | nc 0 1600
7. Verify in Graylog : the message appears but only the "testdecode" field is parsed.
## Context

Well, a vast portion of my message keys contains space but also slash, etc.

## Your Environment

- Graylog Version: 2.0.3
- Elasticsearch Version: 2.3.2
- MongoDB Version: 3.2.8
- Operating System: Debian 8.5
- Browser version: Firefox 47.0.1

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.