Input Extractor Failed after upgrade to 7.1.0

[mulo]

1. Describe your incident:

After Upgrade to from 7.0.6 to 7.1.0, one of my input extractor not working anymore. I try to edit the extractors, but the configuration page for this input extractors load infinity. I have other inputs with extractors, those working fine and also the config page is loading.

Printscreen of the page:

2. Describe your environment:

• OS Information: Ubuntu 24.04.4 (6.8.0-117-generic)

• Package Version: 7.1.2+adc6268

• Service logs, configurations, and environment variables: 2 Graylog-Server, 3 Graylog-Datanodes.

• Affected Extractor Types: regex, regex_replace and lookup_tables

3. What steps have you already taken to try and solve the problem?

• Upgrade from 7.1.0 → 7.1.1 → 7.1.2
• Check the serverlogs (journalctl -u graylog-server and /var/log/graylog-server/server.log) → no events, when i try to access the input extractor
• I can access the mongodb and see the input. I’m not shure if this is a good idea to delete the input extractor in the database
• Last try is to delete the input and create a new one. but hopefully, there is a better solution.

4. How can the community help?

• Is it possible to delete the config for this extractor in the mongodb? I have a backup of the extractors and could import them again
• Has anyone a similar problem with input extractors?

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

[mulo]

I forgot to say, that i see this post here:

Fix Manage Extractors link for local inputs (`7.1`) (#25923)

Im not shure, if this is the same issue, and my problem still exists in version 7.1.2+adc6268.

[dennis]

Hey @mulo,

Im not shure, if this is the same issue, and my problem still exists in version 7.1.2+adc6268.

that’s interesting, it should have been fixed with 7.1.2. Do you see anything in your browser’s JS console?

[mulo]

Hi dennis

In the browsers webconsole i see a Error 500 for this call:

GET http://hidden:9000/api/system/inputs/655a04437eda75011f6294fa/extractors

When i made a Call for this api endpoint, i see this message:

{“type”:“ApiError”,“message”:“”}

The call was made without any loadbalancer or proxy between the client and graylog-server.

Regards,

mulo

[dennis]

@mulo: That is interesting. Do you see an exception in your Graylog server log?

[mulo]

No exception in /var/log/graylog-server/server.log

Only a few unresolvable reverse lookups from the dns-lookup-table in the last hour.

The loglevel of the subsystem graylog is on informational at the moment.

[mulo]

I raise the loglevel to debug, what creates a lot of messages…

Maybe here are some interesting messages. But I’m not shure if the first error is related to my issue. But the id in the error “c071cfc0-5245-11ef-8312-0050568e15a3” is definitely part of the extractor with the error (I can see the id in the mongodb) :

2026-05-21T16:54:13.564+02:00 ERROR [InputServiceImpl] Cannot build extractor from persisted data. Skipping. Document: {“creator_user_id”: “admin”, “source_field”: “source”, “condition_type”: “none”, “title”: “Source Firewall”, “type”: “lookup_table”, “cursor_strategy”: “copy”, “target_field”: “src_fw”, “extractor_config”: {“lookup_table_name”: “dns-lookup-table-internal”}, “condition_value”: “”, “converters”: , “id”: “c071cfc0-5245-11ef-8312-0050568e15a3”, “order”: 2}
2026-05-21T16:54:13.566+02:00 ERROR [AnyExceptionClassMapper] Unhandled exception in REST resource
2026-05-21T16:54:13.566+02:00 DEBUG [accesslog] x.x.x.x xxxx [-] “GET api/system/inputs/655a04437eda75011f6294fa/extractors” Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 500 -1

[dennis]

@mulo: That is weird. Could you send me the contents of your inputs collection from MongoDB? This way I could try to reproduce it locally, speeding up fixing it a lot. If you want to do this, just send it to .com (obfuscating for avoiding the usual crawling/spamming).

[mulo]

Shure, here is the json from the mongodb with only this input configuration with the issue:

sophos_input.json

The link will only work 24h.

[Wine_Merchant]

Are you able to test the lookup table associated with this extractor(“dns-lookup-table-internal”), is it available and functioning as normal?

[mulo]

@Wine_Merchant that was the problem. The name of the lookup table was wrong. after I change to lookuptable name to “dns-lookup-table-internal”, I was able to access the extractor configuration and correct the lookup table.

Thank you guys for your support.

[dennis]

@mulo: Great to hear that you were able to solve your problem. This is still a bug that needs to be fixed, I think. Unfortunately, I was not able to grab your JSON file due to a long weekend over here. Can you re-upload it and/or provide steps how to recreate that configuration?

Update: I figured out how to do it, it’s actually pretty easy: Configure a lookup table extractor and then delete the lookup table use.

[mulo]

@dennis I uploaded the file again. The link is valid till next friday:

sophos_input.json

Please let me know, if you need some further informations.