Could not import content pack. Invalid JSON

[mattolan (Matthew Olan)]

I am trying to import the following Content pack for Unifi networking equipment from the community

breakandinspect/graylog/blob/master/GRAYLOG_Ubiquiti_Extractors.json

but I get the above error from Graylog stating it is not a valid JSON file.
I used an online JSON validation tool https://jsonlint.com/ to check and it says it is valid.

I am using Graylog 4.1.3 (Private Build 1.8.0_292 on Linux 5.4.0-81-generic)

how do I troubleshoot this and get the content pack to import?
I am brand new to Graylog and the error doesn’t provide any guidance.

Thanks

[aaronsachs]

Hey there, the logs should give you some additional info (/var/log/graylog/server/server.log). Or if you look at your browser’s developer console, you should get some additional info. FWIW I’m on 4.1.3 and able to import the extractors without issue:

I went to https://raw.githubusercontent.com/breakandinspect/graylog/master/GRAYLOG_Ubiquiti_Extractors.json and copied the JSON and pasted it into the window after clicking on “Actions” → “Import extractors”:

[mattolan (Matthew Olan)]

Thanks, That helped me fix it. I was trying to import it via the System >> Content Packs >> Upload button since this is the screen that took me to the market place where I got the files from.

But from you screenshot I could tell you were not importing the json files from that location.
I figured out you are in System >> Inputs >> Manage Extractors (for the Syslog input in question)

Adding the json file directly as an extractor in that location worked… This is not at all obvious for someone new to GrayLog

[aaronsachs]

I agree that it’s definitely not intuitive and that’s not an ideal first experience we like folks to have. I think part of the problem may arise from the fact that the repo that houses those extractors is quite old (circa 2.2/4 years ago) and a lot has changed in Graylog in 4 years. So those extractors haven’t been converted to a content pack, they’re just the raw JSON. Ideally, they’d be content packs and you could just import them without having to to worry about the raw JSON.