Graylog2 / Graylog2/graylog2-server

Fields with dots are inaccessible in the pipeline processor

Open
#6,588 4 comments 2 reactions 0 assignees View on GitHub
question triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

When a field contains a dot, its values can not be retrieved in a pipeline rule.

Example:

```
rule "test"
when
true
then
debug($message.somefield.withdot)
end
```

## Expected Behavior
I can display the value of the field with a dot.

## Current Behavior
The value of the field is null (debug displays nothing)

## Possible Solution
A value getter outside the dot-syntax is required. For example:

* `$message["somefield.withdot"]`
* `get_value("somefield.withdot", $message)`

## Steps to Reproduce (for bugs)
Inject a field, that has a dot in its name using e.g. GELF. (The JMXTrans GelfWriter for example generates fields with dots to separate MBeans from the Classes)

## Context
We're using JMXTrans to inject JMX metrics into Graylog and I would like to calculate a heap usage in percent out of the fields sun_management_MemoryImpl.HeapMemoryUsage_used and sun_management_MemoryImpl.HeapMemoryUsage_committed. The fields show up in the UI with underscores, but in the pipeline processor the dots are used.

## Your Environment

* Graylog Version: 3.1.1
* Elasticsearch Version: 5.6.16
* MongoDB Version: 4.0.12
* Operating System: Ubuntu 16.04
* Browser version: Chrome 77.0.3865.90

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.