Graylog not accepting value of array of when sending data to GELF HTTP

Graylog Central (peer support)
1

Hi All,

I am running graylog 3.1.1 version with GELF HTTP input and I started sending data to gelf port and data is receiving in stream and below is the message form the stream,

image
image.png1353×560 20.6 KB

The sourceStreams field values is an array but when its storing in elasticsearch its not storina as array instead its storing as string and below is the document from elasticsearch,

      "eventId" : "01DPQVDZRZFWVPZ25CKYZ",
      "timerange_end" : "2019-10-09T08:51:02.984Z",
      "source" : "graylog.asia-south1-c.profound-veld.internal",
      "message" : "IIS_HighVolume_500_ErrorCodes:count()=46.0",
      "priority" : 2,
      **"sourceStreams" : """["5d9b30ae17d4b303c5793f21"]""",**
      "event_definition_type" : "aggregation-v1",
      "event_definition_id" : "5d9b325e17d4b303c579410f",
      "timestamp" : "2019-10-09 17:19:19.100",
      "timerange_start" : "2019-10-09T08:50:02.985Z"

Please let me know your thoughts why this kind of behaviour happening in graylog and correct me if I am doing anything wrong.

Thanks,
Ganeshbabu R

2

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.