ERROR [CsvConverter] Different number of columns in CSV data (21) and configured field names (23). Discarding input

Graylog Central (peer support)
1

Dear all, we are using 5.0.x I cannot find what is generating this error.
This issue is specific for one of the inputs (the SYSLOG one , not the GELF one)
I cannot find wich extractor is impacted. I deleted all the pipelines - nothing changed.

Help me please

2

Are you seeing that in graylog’s server.log? Are there any other log entries that may correspond to this?

I found the error in the source here.

This is a “CSV to Fields” converter configured for a specific extractor:

image
image869×417 51.8 KB

If you can’t find which input the extractor is configured on, you can query mongodb:

Mongo 5 and older:

mongo graylog --eval 'db.getCollection("inputs").find({extractors: {$exists: true}})' --quie

Mongo 6 and later:

mongosh graylog --eval 'db.getCollection("inputs").find({extractors: {$exists: true}})' --quie

This will return all records where an input has an extractor configured:

[
  {
    _id: ObjectId("62557054e3a1b140332e4dd2"),
    creator_user_id: 'admin',
    configuration: {
      ...
    },
    name: '<redacted>',
    created_at: ISODate("2022-04-12T12:28:04.798Z"),
    global: true,
    desired_state: 'RUNNING',
    type: '<redacted>',
    title: '<redacted>',
    content_pack: null,
    extractors: [
      {
        creator_user_id: '<redacted>',
        source_field: '<redacted>',
        condition_type: 'string',
        title: '<redacted>',
        type: 'copy_input',
        cursor_strategy: 'copy',
        target_field: '<redacted>',
        extractor_config: {},
        condition_value: '<redacted>',
        converters: [ { type: 'csv', config: { column_header: '1,2,3' } } ],
        id: '59f6b070-7f29-11ee-b413-0242f6f8757b',
        order: Long("0")
      }
    ]
  }
]

Once you find the input you can copy the “ObjectId” and use that to navigate to the applicable extractors page for that input:

https://<your graylog>/system/inputs/62557054e3a1b140332e4dd2/extractors

Hope that helps.

3

Thanks, the only ones are CSV converter used in the PfSense Extractors … probably the extractors for the Plus version are not available?

4

Issues like this are why I switched from using CSV extractors to pipelines. By using multiple stages I could parse out the various pieces and not have to write an extractor for every different type of network traffic (OPNSense in my case).

1 Like
5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.