# Input Extractor Failed after upgrade to 7.1.0 **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [May 21, 2026, 10:17am UTC](https://community.graylog.org/t/input-extractor-failed-after-upgrade-to-7-1-0/37308 "2026-05-21T10:17:23Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![mulo](https://avatars.discourse-cdn.com/v4/letter/m/a9a28c/32.png) [@mulo](https://community.graylog.org/u/mulo)\ **Post date:** [May 21, 2026, 10:17am UTC](https://community.graylog.org/t/input-extractor-failed-after-upgrade-to-7-1-0/37308/1 "2026-05-21T10:17:23Z")
**1. Describe your incident:** After Upgrade to from 7.0.6 to 7.1.0, one of my input extractor not working anymore. I try to edit the extractors, but the configuration page for this input extractors load infinity. I have other inputs with extractors, those working fine and also the config page is loading. Printscreen of the page: ![Bildschirmfoto 2026-05-21 um 12.06.53](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/2/5/25830486bcb2c848387e366f22657104a80f0cdf.png) **2. Describe your environment:** - OS Information: Ubuntu 24.04.4 (6.8.0-117-generic) - Package Version: 7.1.2+adc6268 - Service logs, configurations, and environment variables: 2 Graylog-Server, 3 Graylog-Datanodes. - Affected Extractor Types: regex, regex\_replace and lookup\_tables **3. What steps have you already taken to try and solve the problem?** - Upgrade from 7.1.0 → 7.1.1 → 7.1.2 - Check the serverlogs (journalctl -u graylog-server and /var/log/graylog-server/server.log) → no events, when i try to access the input extractor - I can access the mongodb and see the input. I’m not shure if this is a good idea to delete the input extractor in the database - Last try is to delete the input and create a new one. but hopefully, there is a better solution. **4. How can the community help?** - Is it possible to delete the config for this extractor in the mongodb? I have a backup of the extractors and could import them again - Has anyone a similar problem with input extractors? **Helpful Posting Tips:** [Tips for Posting Questions that Get Answers](https://community.graylog.org/t/tips-for-posting-questions-that-get-answers/21828) [Hold down CTRL and link on link to open tips documents in a separate tab] ---
**Author:** ![mulo](https://avatars.discourse-cdn.com/v4/letter/m/a9a28c/32.png) [@mulo](https://community.graylog.org/u/mulo)\ **Post date:** [May 21, 2026, 10:26am UTC](https://community.graylog.org/t/input-extractor-failed-after-upgrade-to-7-1-0/37308/2 "2026-05-21T10:26:59Z")
I forgot to say, that i see this post here: > > > Note: This is a backport of #25907 to \`7.1\`. > > \*\*Note:\*\* This needs a backport to… \`7.1\`. > > \## Description > > The \`Manage extractors\` action on the Inputs overview page generated an invalid URL for local (non-global) inputs because it relied on a \`currentNode\` prop that was always passed as \`null\` from \`useTableElements\`. Clicking the link routed to a malformed path with \`undefined\` in place of the node ID. > > The fix uses the input's own \`node\` field to build the local extractors route and removes the unused \`currentNode\` prop from \`InputsActions\`. > > \## Motivation and Context > > Users could not reach the extractors page for local inputs from the new inputs overview — the link was broken. > > \## How Has This Been Tested? > > Manually verified that the \`Manage extractors\` link now resolves to a valid local-input extractors URL for non-global inputs and continues to use the global route for global inputs. > > \## Screenshots (if appropriate): > > \## Types of changes > > \- \[x\] Bug fix (non-breaking change which fixes an issue) > \- \[\] New feature (non-breaking change which adds functionality) > \- \[\] Refactoring (non-breaking change) > \- \[\] Breaking change (fix or feature that would cause existing functionality to change) > > \## Checklist: > > \- \[x\] My code follows the code style of this project. > \- \[\] My change requires a change to the documentation. > \- \[\] I have requested a documentation update. > \- \[x\] I have read the \*\*CONTRIBUTING\*\* document. > \- \[\] I have added tests to cover my changes. Im not shure, if this is the same issue, and my problem still exists in version 7.1.2+adc6268. ---
**Author:** ![dennis](https://avatars.discourse-cdn.com/v4/letter/d/e56c9b/32.png) [@dennis](https://community.graylog.org/u/dennis)\ **Post date:** [May 21, 2026, 12:32pm UTC](https://community.graylog.org/t/input-extractor-failed-after-upgrade-to-7-1-0/37308/3 "2026-05-21T12:32:56Z")
Hey @mulo, > Im not shure, if this is the same issue, and my problem still exists in version 7.1.2+adc6268. that’s interesting, it should have been fixed with 7.1.2. Do you see anything in your browser’s JS console? ---
**Author:** ![mulo](https://avatars.discourse-cdn.com/v4/letter/m/a9a28c/32.png) [@mulo](https://community.graylog.org/u/mulo)\ **Post date:** [May 21, 2026, 1:54pm UTC](https://community.graylog.org/t/input-extractor-failed-after-upgrade-to-7-1-0/37308/4 "2026-05-21T13:54:01Z")
Hi dennis In the browsers webconsole i see a Error 500 for this call: GET [http://hidden:9000/api/system/inputs/655a04437eda75011f6294fa/extractors](https://hidden:9000/api/system/inputs/655a04437eda75011f6294fa/extractors) When i made a Call for this api endpoint, i see this message: {“type”:“ApiError”,“message”:“”} The call was made without any loadbalancer or proxy between the client and graylog-server. Regards, mulo ---
**Author:** ![dennis](https://avatars.discourse-cdn.com/v4/letter/d/e56c9b/32.png) [@dennis](https://community.graylog.org/u/dennis)\ **Post date:** [May 21, 2026, 2:12pm UTC](https://community.graylog.org/t/input-extractor-failed-after-upgrade-to-7-1-0/37308/5 "2026-05-21T14:12:17Z")
@mulo: That is interesting. Do you see an exception in your Graylog server log? ---
**Author:** ![mulo](https://avatars.discourse-cdn.com/v4/letter/m/a9a28c/32.png) [@mulo](https://community.graylog.org/u/mulo)\ **Post date:** [May 21, 2026, 2:52pm UTC](https://community.graylog.org/t/input-extractor-failed-after-upgrade-to-7-1-0/37308/6 "2026-05-21T14:52:13Z")
No exception in /var/log/graylog-server/server.log Only a few unresolvable reverse lookups from the dns-lookup-table in the last hour. The loglevel of the subsystem graylog is on informational at the moment. ---
**Author:** ![mulo](https://avatars.discourse-cdn.com/v4/letter/m/a9a28c/32.png) [@mulo](https://community.graylog.org/u/mulo)\ **Post date:** [May 21, 2026, 3:16pm UTC](https://community.graylog.org/t/input-extractor-failed-after-upgrade-to-7-1-0/37308/7 "2026-05-21T15:16:14Z")
I raise the loglevel to debug, what creates a lot of messages… 🙂 Maybe here are some interesting messages. But I’m not shure if the first error is related to my issue. But the id in the error “c071cfc0-5245-11ef-8312-0050568e15a3” is definitely part of the extractor with the error (I can see the id in the mongodb) : 2026-05-21T16:54:13.564+02:00 ERROR [InputServiceImpl] Cannot build extractor from persisted data. Skipping. Document: {“creator\_user\_id”: “admin”, “source\_field”: “source”, “condition\_type”: “none”, “title”: “Source Firewall”, “type”: “lookup\_table”, “cursor\_strategy”: “copy”, “target\_field”: “src\_fw”, “extractor\_config”: {“lookup\_table\_name”: “dns-lookup-table-internal”}, “condition\_value”: “”, “converters”: , **“id”: “c071cfc0-5245-11ef-8312-0050568e15a3”** , “order”: 2} 2026-05-21T16:54:13.566+02:00 ERROR [AnyExceptionClassMapper] Unhandled exception in REST resource 2026-05-21T16:54:13.566+02:00 DEBUG [accesslog] x.x.x.x xxxx [-] “GET api/system/inputs/655a04437eda75011f6294fa/extractors” Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 500 -1 ---
**Author:** ![dennis](https://avatars.discourse-cdn.com/v4/letter/d/e56c9b/32.png) [@dennis](https://community.graylog.org/u/dennis)\ **Post date:** [May 22, 2026, 8:34am UTC](https://community.graylog.org/t/input-extractor-failed-after-upgrade-to-7-1-0/37308/8 "2026-05-22T08:34:24Z")
@mulo: That is weird. Could you send me the contents of your `inputs` collection from MongoDB? This way I could try to reproduce it locally, speeding up fixing it a lot. If you want to do this, just send it to .com (obfuscating for avoiding the usual crawling/spamming). ---
**Author:** ![mulo](https://avatars.discourse-cdn.com/v4/letter/m/a9a28c/32.png) [@mulo](https://community.graylog.org/u/mulo)\ **Post date:** [May 22, 2026, 9:21am UTC](https://community.graylog.org/t/input-extractor-failed-after-upgrade-to-7-1-0/37308/9 "2026-05-22T09:21:19Z")
Shure, here is the json from the mongodb with only this input configuration with the issue: [sophos\_input.json](https://1drv.ms/u/c/c629e798013e22fb/IQCwXTMeqc7iSoZAmW9Tx2JQAfCchYFZHC-GZmT_Noxfb-Y?e=XT49XU) The link will only work 24h. ---
**Author:** ![Wine\_Merchant](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/wine_merchant/32/14596_2.png) [@Wine\_Merchant](https://community.graylog.org/u/Wine_Merchant)\ **Post date:** [May 22, 2026, 10:31am UTC](https://community.graylog.org/t/input-extractor-failed-after-upgrade-to-7-1-0/37308/10 "2026-05-22T10:31:20Z")
Are you able to test the lookup table associated with this extractor(“dns-lookup-table-internal”), is it available and functioning as normal? ---
**Author:** ![mulo](https://avatars.discourse-cdn.com/v4/letter/m/a9a28c/32.png) [@mulo](https://community.graylog.org/u/mulo)\ **Post date:** [May 22, 2026, 1:10pm UTC](https://community.graylog.org/t/input-extractor-failed-after-upgrade-to-7-1-0/37308/11 "2026-05-22T13:10:49Z")
@Wine_Merchant that was the problem. The name of the lookup table was wrong. after I change to lookuptable name to “dns-lookup-table-internal”, I was able to access the extractor configuration and correct the lookup table. Thank you guys for your support. ---
**Author:** ![dennis](https://avatars.discourse-cdn.com/v4/letter/d/e56c9b/32.png) [@dennis](https://community.graylog.org/u/dennis)\ **Post date:** [May 26, 2026, 7:11am UTC](https://community.graylog.org/t/input-extractor-failed-after-upgrade-to-7-1-0/37308/12 "2026-05-26T07:11:39Z")
@mulo: Great to hear that you were able to solve your problem. This is still a bug that needs to be fixed, I think. Unfortunately, I was not able to grab your JSON file due to a long weekend over here. Can you re-upload it and/or provide steps how to recreate that configuration? **Update:** I figured out how to do it, it’s actually pretty easy: Configure a lookup table extractor and then delete the lookup table use. ---
**Author:** ![mulo](https://avatars.discourse-cdn.com/v4/letter/m/a9a28c/32.png) [@mulo](https://community.graylog.org/u/mulo)\ **Post date:** [May 26, 2026, 9:12am UTC](https://community.graylog.org/t/input-extractor-failed-after-upgrade-to-7-1-0/37308/13 "2026-05-26T09:12:32Z")
@dennis I uploaded the file again. The link is valid till next friday: [sophos\_input.json](https://1drv.ms/u/c/c629e798013e22fb/IQCwXTMeqc7iSoZAmW9Tx2JQAZc2y5MnWH-hiHHPLKZ6Hb4?e=tgvc66) Please let me know, if you need some further informations. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [June 9, 2026, 9:12am UTC](https://community.graylog.org/t/input-extractor-failed-after-upgrade-to-7-1-0/37308/14 "2026-06-09T09:12:37Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.