Graylog2 / Graylog2/graylog2-server
JSON extractor ignore keys with space or other non-alpha num characters
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
The JSON extractor can't deal with special characters, including space, in the key. The preview of the extractor will work, but it will doesn't actually work on the messages.
Graylog version : 2.0.3.
## Expected Behavior
The expected behavior is that the JSON extractor can deal with everything described in the json standard.
## Current Behavior
The fields that contains non-aplha(num?) character are ignored when the actual extracting occurs (the preview is ok).
## Steps to Reproduce (for bugs)
1. Setup a raw tcp input, let's say 127.0.0.1:1600
2. Send a regular json message in it with a strict alphanum key :
echo '{ "testdecode":"test ok" }' | nc 0 1600
3. In Graylog, setup a JSON extractor on the message field, without flatening. Send the same message again and verify : it should be parsed as expected.
4. Now, introduce some spaces in the same message :
echo '{ "test de code":"test ok" }' | nc 0 1600
5. Verify in Graylog : the message appears in Graylog but seems unparsed.
6. Now, put both fields :
echo '{ "testdecode":"test ok", "test de code":"test ok" }' | nc 0 1600
7. Verify in Graylog : the message appears but only the "testdecode" field is parsed.
## Context
Well, a vast portion of my message keys contains space but also slash, etc.
## Your Environment
- Graylog Version: 2.0.3
- Elasticsearch Version: 2.3.2
- MongoDB Version: 3.2.8
- Operating System: Debian 8.5
- Browser version: Firefox 47.0.1
Contributor guide
Assessment
This issue has not been assessed yet.