Hello, I have identical problem as in topic “Indexer failures and regex with set_field” in Pipeline by Grakkal. I have read the documentation that was in answer of jochen, but I have problems with creating a new index template.
I want to have field look like:
a1_fw_device_name
XG210
but I have:
a1_fw_device_name
{"0":"XG210"}
Example of $message.message:
device=“SFW” date=2020-02-10 time=15:19:35 timezone=“CET” device_name=“XG210” log_type=“Firewall” log_component=“Firewall Rule” log_subtype=“Allowed” status=“Allow” priority=Information duration=0 fw_rule_id=132 policy_type=1 user_name=""
My code of rule for pipeline:
rule "Sorted fields of Sophos syslog"
when
true
then
let str_msg = to_string($message.message);
let fw_device_name = regex("device_name=\"([^\"]*)\"", str_msg);
set_field("a1_fw_device_name", fw_device_name["0"]);
end
My try to create new index:
{
"template": "graylog_*",
"mappings" : {
"message" : {
"properties" : {
"0" : {
"type" : "text"
}
}
}
}
}
I still have error {“type”:“mapper_parsing_exception”,“reason”:“object mapping for [a1_fw_device_name] tried to parse field [a1_fw_device_name] as object, but found a concrete value”}.
Version: Graylog 3.1.4+1149fe1.
Could you say please, what I do wrong?
Many thanks in advance
