HTTP JSONPath Data Adapter Issue with Colon Character in Key

Graylog Central (peer support)
1

Hey,

I am having trouble querying a JSON api with keys that contain colon characters (IPv6 addresses).

See screenshot for an exemplaric data adapter configuration with that issue:

data-adapter
data-adapter926Ă—811 44.6 KB

Using this data adapter works fine for IPv4.
When using it with an IPv6 address I get errors like this:

May 13 20:08:40 graylog graylogctl[25284]: 2018-05-13 20:08:40,619 WARN : org.graylog2.lookup.adapters.HTTPJSONPathDataAdapter - HTTP request for key <2001:a62:70e:yyyy:fa59:71ff:fe1d:xxxx> failed: Response{protocol=http/1.1, code=400, message=Bad Request, url=https://api.iptoasn.com/v1/as/ip/2001%3Aa62%3A70e%3Ayyyy%3Afa59%3A71ff%3Afe1d%3Axxxx}

(IP in example obfuscated)

It seems like Graylog is encoding the colons which is not accepted by the API endpoint.

Is there any way to disable this behavior or work around the issue?
(I have to use several APIs with the same issue that are unwilling to fix it on their side)

Thanks!

2

No, that’s currently not possible.

That being said, it’s a shortcoming of the HTTP API you’re using that they’re not accepting URI-encoded entities in the URI. I know this doesn’t help in this case, but it’s the rationale why we probably won’t provide a configuration setting to change the encoding-behavior of the HTTP client used in Graylog. :wink:

If you think this is a relevant feature, please open an issue at Issues · Graylog2/graylog2-server · GitHub and provide a few HTTP APIs as example, which are incompatible with the URI-encoding used in Graylog.

1 Like
3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.