I’ve configured a single (Grok) extractor running against an input. When I load the sample message both the condition regex and the try against example succeed. However, searching yields no fields are getting saved when new messages arrive. The extractors “Details” link shows that there are thousands of hits, which leads me to believe it should be working. I’m very new to Graylog, but haven’t been able to dig up any reason for this behavior. Other test extractors that I setup using regex worked as expected (now removed to simplify things).
This is a stock Ubuntu 20.04 install running mongodb 4.4, ES 7.10.2 and Graylog Open 4.2.1-1
Here’s a sample message:
hostname Eventreader: @@202,clientJoin,“apMac"=“12:12:12:12:12:12”,“clientMac”=“12:66:12:12:12:12”,“ssid”=“userWLANname”,“bssid”=“12:12:12:12:12:12”,“userId”="",“wlanId”=“100”,“iface”=“wlan0”,“tenantUUID”=“839f87c6-d116-497e-afce-438211rbd32c”,“apName”=“AP209”,“apGps”=“10.20,-135.9”,“userName”="user@gmail.com”,“vlanId”=“101”,“radio”=“g/n”,“encryption”=“WPA2-AES”,“Instantaneous rssi”=“0”,“Xput”=“0”,“fwVersion”=“1.4.3.0”,“model”=“100”,“zoneUUID”=“bf34718e-c3ff-4ec8-8d5e-75423ab81f4a”,“zoneName”=“000000000001”,“timeZone”=“MST+7”,“apLocation”=“000000000001”,“apGps”=“10.20,-135.9”,“apIpAddress”=“10.12.1.1”,“apIpv6Address”="",“apGroupUUID”=“f9c107c8-8ead-4899-bda7-b9145678890d”,“domainId”=“666fa0e1-5786-43fe-9bea-b34567893ef1”,“serialNumber”=“000002008341”,“domainName”=“BOB - Desert”,“wlanGroupUUID”=“11476630-30f7-11ec-86ae-34567890f052”,“idealEventVersion”=“3.5.1”,“apDescription”=“kitchen”
And the Grok pattern is as follows:
%{DATA:Host} %{DATA:Type}: @@%{INT:eventCode},%{DATA:eventType},“apMac”="%{MAC:apMAC}",“clientMac”="%{MAC:clientmac}",“ssid”="%{DATA:ssid}",“bssid”="%{MAC:UNWANTED}",“userId”="%{DATA}",“wlanId”="%{INT:UNWANTED}",“iface”="%{DATA:UNWANTED}",“tenantUUID”="%{DATA:UNWANTED}",“apName”="%{DATA:apname}",“apGps”="%{DATA:UNWANTED}"
The pattern doesn’t match every field (I’m assuming if it matches from the beginning that’s expected - I’m new to Grok as well). Named captures only is selected, and the connectional regex is simply clientJoin.
Everything succeeds in the Extractor configuration - but no changes in the search. The search filter does seem to recognize the new keys (apMac, clientMac, etc), but there are no results stored.
I’m sure I must be missing something trivial at this point. I tried similar extractors with Regex, which are working for some other syslog data, and received the same result. is there an issue with the incoming message size, or something else?
Thanks in advance.
Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]