Graylog2 / Graylog2/graylog2-server
Json Parser Exception with unquoted Field Names in Graylog 3.01
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
When trying to parse json from osquery with these rules:
```
rule "OSQuery Parser"
when
contains(to_string($message.winlogbeat_log_name), "osquery", true) &&
contains(to_string($message.winlogbeat_event_data_Message), "{\"", true)
then
let json = parse_json(to_string($message.winlogbeat_event_data_Message));
set_fields(to_map(json));
let json2 = parse_json(to_string($message.columns));
debug(json2);
set_fields(to_map(json2));
end
```
This exception happens due to missing double quotes. Research suggests that we can enable an option to allow this to work:
https://www.mkyong.com/java/jackson-was-expecting-double-quote-to-start-field-name/
add JsonParser.Feature.ALLOW_UNQUOTED_FIELD_NAMES in the ObjectMapper configuration
```
2019-04-07T21:25:33.823-04:00 WARN [JsonParse] Unable to parse JSON
com.fasterxml.jackson.core.JsonParseException: Unexpected character ('a' (code 97)): was expecting double-quote to start field name
at [Source: {action=PROC_CREATE, cmdline="C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\AutomationManager.ScriptRunner64.exe" "C:\ProgramData\N-Able Technologies\AutomationManager\scripts\d9e70f8d-cf01-4eac-8116-23068aee0c54" {StandardProfile,System.String;DomainProfile,System.String;PublicProfile,System.String;Result,System.Double;ResultString,System.String} d9e70f8d-cf01-4eac-8116-23068aee0c54, eid=05EF49D8-D228-4CC0-8970-3D7900F8FFFF, owner_uid=NT AUTHORITY\SYSTEM, parent_path=C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe, parent_pid=5444, parent_process_guid=23EEC624-58E1-11E9-BBCF-38BAF858BC44, path=C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\AutomationManager.ScriptRunner64.exe, pid=26116, process_guid=23EECC73-58E1-11E9-BBCF-38BAF858BC44, time=1554686700, utc_time=Mon Apr 8 01:25:00 2019 UTC}; line: 1, column: 3]
at com.fasterxml.jackson.core.JsonParser._constructError(JsonParser.java:1702) ~[graylog.jar:?]
```
Is there a better way to parse the json and the sub-json without throwing an error?
Contributor guide
Assessment
This issue has not been assessed yet.