API Create Extractor Troubles

I am trying to use the API to create an extractor for a message input. I am using the “Try it out!” button on the api browser link. Here is the JSON I am trying to use.

{
“title”: “ASA TCP Connection Teardown”,
“cut_or_copy”: “copy”,
“source_field”: “message”,
“target_field”: “”,
“extractor_type”: “grok”,
“extractor_config”: {
“grok_pattern”: “ASA-\d-%{WORD:asa_messageid:int}: %{WORD:asa_action} %{WORD:asa_proto} connection %{BASE10NUM:asa_conn_id} for %{NOTSPACE:asa_interface_in}:%{IPV4:asa_src_ip}/%{BASE10NUM:asa_src_port}to %{NOTSPACE:asa_interface_out}:%{IPV4:asa_dst_ip}/%{BASE10NUM:asa_dst_port} duration %{TIME:asa_conn_durration} bytes %{BASE10NUM:asa_conn_bytes;long}”
},
“converters”: “”,
“condition_type”: “regex”,
“condition_value”: “ASA-\d-302014: Teardown TCP”,
“order”: 0
}

It seems like its having an issue with the converters section. When I input it I get:
{
“type”: “ApiError”,
“message”: “Can not construct instance of java.util.LinkedHashMap: no String-argument constructor/factory method to deserialize from String value (’’)\n at [Source: org.glassfish.jersey.message.internal.ReaderInterceptorExecutor$UnCloseableInputStream@4ce8f6f1; line: 10, column: 19] (through reference chain: org.graylog2.rest.models.system.inputs.extractors.requests.CreateExtractorRequest[“converters”])”
}

If I remove it says that it has a problem with a null convertor:

{
“type”: “ApiError”,
“message”: “Can not construct instance of org.graylog2.rest.models.system.inputs.extractors.requests.CreateExtractorRequest, problem: Null converters\n at [Source: org.glassfish.jersey.message.internal.ReaderInterceptorExecutor$UnCloseableInputStream@20c394d8; line: 13, column: 1]”
}

Any help would be greatly appreciated!

I guess you need to double escape your grok pattern - but that is just a guess.

I thought it was something like that too so I did this:

{
“title”: “ASA TCP Connection Teardown”,
“cut_or_copy”: “copy”,
“source_field”: “message”,
“target_field”: “”,
“extractor_type”: “grok”,
“extractor_config”: {},
“converters”: “”,
“condition_type”: “regex”,
“condition_value”: “ASA-\d-302014: Teardown TCP”,
“order”: 0
}

Same Error. I don’t think convertors are even allowed with a Grok type extractor so I am not sure why the convertors string would be required or used in this case. I am not sure how to work around this but it seems this API call wouldn’t be much good if this simple input functionality doesn’t work.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.