Graylog2 / Graylog2/graylog2-server
JSON extractor not properly extracting fields
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
The JSON extractor is not extracting all fields when expected.
## Expected Behavior
Let's take this JSON data:
```
{"searched": {"visible": true, "location": {"$near": {"$geometry": {"type": "Point", "coordinates": [51.50868903816219, -0.16934394836425784]}, "$maxDistance": 2617.0018316519327}}, "date": {"$gt": {"$date": 1560034800000}, "$lte": {"$date": 1560121200000}}, "public": true}, "retrieved": []}
```
The extractor "Try" button/preview creates all the different subfields
properly:
```
searched_location_$near_$geometry_type
Point
searched_date_$gt_$date
1560034800000
searched_visible
searched_date_$lte_$date
1560121200000
retrieved
searched_location_$near_$geometry_coordinates
51.50868903816219, -0.16934394836425784
searched_public
searched_location_$near_$maxDistance
2617.0018316519327
```
Unfortunately, they are not extracted in the production.
## Current Behavior
Only a couple of fields are extracted like `searched_public`.
* Graylog Version: 3.0.2
* Elasticsearch Version: 6.6.2
* MongoDB Version: 4.1.2
* Operating System: Mint
* Browser version: Chrome 74
Contributor guide
Assessment
This issue has not been assessed yet.