Graylog2 / Graylog2/graylog2-server

JSON Extractor doesn't work with ESET Syslog

Open
#7,318 19 comments 0 reactions 0 assignees View on GitHub
bug triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Hi,
I'm tried to extract JSON message sended by ESET with builtin JSON Extractor, but I'm unable to do this.

I'm getting from Eset ESMC syslogs log which have in message field this
`{"event_type":"Audit_Event","ipv4":"www","hostname":"asfasfaas","source_uuid":"fase4b96","occured":"29-Jan-2020 09:50:07","severity":"Information","domain":"Domain group","action":"Logout","target":"wfe56615b","detail":"Logging out domain user 'asf.asf'.","user":"asf.asf","result":"Success"}`

This message should be properly extracted to multiple fields, but I have each time only `Nothing will be extracted` message.

![12](https://user-images.githubusercontent.com/41945903/73353534-d33f7b00-4293-11ea-9434-a22bf720175c.png)

## Steps to Reproduce (for bugs)
1. Configure Eset 7 ESMC to send JSON Syslogs
2. Create input in Graylog
3. Wait to first log message
4. Try to create JSON extractor(Just try to get properly text when clicking at "Try" button)

## Your Environment

* Graylog Version: 3.2.0-3.beta.3
* Elasticsearch Version: 6.8.6-1
* MongoDB Version: 4.0.14-1.el7
* Operating System: CentOS 7
* Browser version: Firefox 72.0.2

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.