Graylog2 / Graylog2/graylog2-server

Allow dots in field names again

Open
#4,583 15 comments 12 reactions 0 assignees View on GitHub
elasticsearch improvement
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## Expected Behavior

When using Elasticsearch 5.x or 6.x, Graylog should allow using dots in field names again.

## Current Behavior

Dots in field names are converted to underscores by Graylog.

## Possible Solution

Allow dots in field names again.

In order to not break existing extractors and pipeline rules the conversion should be optional.

The default for this setting should be *disabled*, because otherwise new users will miss to disable it and still have the dots in field names converted to underscores.

## Steps to Reproduce (for bugs)

1. Create a GELF UDP input.
2. Send GELF message with a custom field including a dot:
```
echo -n '{ "version": "1.1", "host": "example.org", "short_message": "A short message", "level": 5, "_with.dot": "foo" }' | nc -w0 -u graylog.example.com 12201
```
3. Search query: `with.dot:foo`
4. No results.

## Context

https://www.elastic.co/guide/en/elasticsearch/reference/2.4/dots-in-names.html
https://www.elastic.co/guide/en/elasticsearch/reference/5.6/release-notes-5.0.0.html

Refs elastic/elasticsearch#19443
Refs #1667
Refs #1721
Refs #2939

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.