Graylog2 / Graylog2/graylog2-server

JSON extractor does not support root arrays

Open
#5,517 5 comments 2 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## Expected Behavior
JSON data should be extracted into multiple messages if the data has a root array, or at the very least the first item in the array should be extracted.

## Current Behavior
The JSON data is not extracted at all.

eg, the following will not create an EventDateTime field as it should:
`[ { "EventDateTime": "2018-12-12T12:12:12" } ]`

## Possible Solution
The current workaround is to add an extractor which strips the square brackets.

## Steps to Reproduce (for bugs)
1. Create a plain text input with a JSON extractor
2. Push a JSON array to it
3. See if the extracted fields are shown

## Context
One of our systems sends JSON data like this. In theory it can send multiple events within the array although I've never seen it do this.

## Your Environment
* Graylog Version: 2.5.1
* Elasticsearch Version: 6.5.3
* MongoDB Version: 3.6.3
* Operating System: Ubuntu 18.04.1
* Browser version: Firefox 64.0

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.