Graylog2 / Graylog2/graylog2-server
JSON Extractor doesn't work with ESET Syslog
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
Hi,
I'm tried to extract JSON message sended by ESET with builtin JSON Extractor, but I'm unable to do this.
I'm getting from Eset ESMC syslogs log which have in message field this
`{"event_type":"Audit_Event","ipv4":"www","hostname":"asfasfaas","source_uuid":"fase4b96","occured":"29-Jan-2020 09:50:07","severity":"Information","domain":"Domain group","action":"Logout","target":"wfe56615b","detail":"Logging out domain user 'asf.asf'.","user":"asf.asf","result":"Success"}`
This message should be properly extracted to multiple fields, but I have each time only `Nothing will be extracted` message.

## Steps to Reproduce (for bugs)
1. Configure Eset 7 ESMC to send JSON Syslogs
2. Create input in Graylog
3. Wait to first log message
4. Try to create JSON extractor(Just try to get properly text when clicking at "Try" button)
## Your Environment
* Graylog Version: 3.2.0-3.beta.3
* Elasticsearch Version: 6.8.6-1
* MongoDB Version: 4.0.14-1.el7
* Operating System: CentOS 7
* Browser version: Firefox 72.0.2
Contributor guide
Assessment
This issue has not been assessed yet.