# Extractor help needed

**URL:** <https://community.graylog.org/t/extractor-help-needed/18937>\
**Category:** Graylog Central (peer support)\
**Created:** [February 27, 2021, 10:44am UTC](https://community.graylog.org/t/extractor-help-needed/18937 "2021-02-27T10:44:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![doadm](https://avatars.discourse-cdn.com/v4/letter/d/9f8e36/32.png) [@doadm](https://community.graylog.org/u/doadm)\
**Post date:** [February 27, 2021, 10:44am UTC](https://community.graylog.org/t/extractor-help-needed/18937/1 "2021-02-27T10:44:30Z")

</div>

Hi folks,

I am new to graylog and am trying to get a grasp on the whole extractor situation. I did manage to sort a few messages using either GROK patterns or regex for a few message types but I am by no means an expert in regex and can’t get my head around how to attempt to extract the individual fields from the following message from UniFi

```
`<14>Feb 27 11:35:01 U7LR,18e829a3542b,v4.3.28.11361: : stahtd[30670]: [STA-TRACKER].stahtd_dump_event(): {"mac":"84:0d:8e:85:f0:49","message_type":"STA_ASSOC_TRACKER","vap":"ath3","event_type":"fixup","assoc_status":"0","event_id":"3","dns_resp_seen":"yes","arp_reply_gw_seen":"yes","auth_ts":"0.0"}`

```

It would be very helpful if someone could point me in the right direction.

My attempt so far was to use a regex extractor and store the `stahtd_dump_event` and wanted to sort the rest out by using a converter but no matter if I use a `CSV to fields` or `key_value=pair`, I don’t get the desired output. I believe that the message is a mix of CSV and key=value pairs.

Am I even on the right track using the converter or would you suggest looking into a different way of approaching the issue?

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [March 1, 2021, 9:44am UTC](https://community.graylog.org/t/extractor-help-needed/18937/2 "2021-03-01T09:44:17Z")

</div>

Try to use json extractor, not CSV if your field `stahtd_dump_event` contains complete string starting and ending with `{}`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [March 15, 2021, 9:44am UTC](https://community.graylog.org/t/extractor-help-needed/18937/3 "2021-03-15T09:44:49Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.