Do slashes in json keys break flatten?

Graylog Central (peer support)
1

I’m on graylog 6.0.8-1, and I have an api call that returns a message like this:

{"text":{"toImport":0,"toExtract":0,"toSend":0},"text2":{"toImport":0,"inWait":0},"numFiles":{"/mnt/place/":0}}

I am using a input doing a GET to import the json with the flatten_message enabled. This way I get all the keys in the followin format:

  • text_toImport : value

After adding the numFiles block it seems that it’s ignored. So far I don’t have a cause but I suspect it might be the slashes on “/mnt/place/”.
I haven’t been able to find any details on the allowed characters here

Any guide will be appreciated,

Thanks a lot

2

Tey turning off flatten_message seeing how the input looks, then worst case you can write a pipeline rule to flatten the json.

3

Thanks, I’ll check this out.

4

Known issue: Allow slash characters in Message keys · Issue #12990 · Graylog2/graylog2-server · GitHub
Flattening in a pipeline rule won’t be any different, since it’s a fundamental limitation of message field names. You’ll need to replace those slashes before flattening.

5

Thanks @patrickmann at the end as you say, I had to modify the program to output a jason with a filesystem indentifier instead of the path.