Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question. Don’t forget to select tags to help index your topic!
1. Describe your incident:
json extractor not working as intended where I have configured it as the following:
Noting this is the only extractor configured for the input. 2. Describe your environment:
Service logs, configurations, and environment variables:
3. What steps have you already taken to try and solve the problem?
I have repeated the process of creating the input, extractor, and streams multiple times and tried to restart the input and stream but behavior didn’t change.
4. How can the community help?
Since I am new to graylog I need to find the reason behind this behavior and solve this issue. As I am using graylog to send alerts to the wazuh indexer this issue is causing errors in wazuh modules as it’s learned to parse alerts with “.” as key separator.
I just searched in ES guides and found this
“Dots are reserved for grouping related fields into subdocuments”
“Use snake case (underscores) for combining words”
So I am just wondering if this is the language ES understands, dots need to be the key separators and underscores are for combining words, and GL mainly needs to send logs to ES, why didn’t GL adapt to this? what is the point here, I am thinking?
It’s always difficult to prioritize issues, since we can’t get to everything; and this issue has not been a significant problem for users to date.
We should definitely improve the UI text in the extractor, since it is misleading. I will also resubmit the underscore issue to triage - it’s been lingering for a long time.
I might not have explained my point very well… it’s not the prohibition that I wanted but allowing it, instead. In my case, Underscores cause to me a big problem! Actually, I am viewing GL alerts from Wazuh dashboard. And since Wazuh dashboard depends on OpenSearch(OS), which understand dots as key separators and underscores as words combiners, it’s unable to lookup the fields correctly and output them!! So I am losing a dozen wazuh features because of this underscore!! From my perspective, all tools should speak the language of ES/OS in order to facilitate integrations between them and make it more useful and valuable!
I appreciate if you could add this in the case opened… Thanks!