Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!
1. Describe your incident:
json extractor not working as intended where I have configured it as the following:
{
“extractors”: [
{
“title”: “WAZUH JSON EXTRACTOR”,
“extractor_type”: “json”,
“converters”: ,
“order”: 0,
“cursor_strategy”: “cut”,
“source_field”: “message”,
“target_field”: “”,
“extractor_config”: {
“list_separator”: ", ",
“kv_separator”: “:”,
“key_prefix”: “”,
“key_separator”: “.”,
“replace_key_whitespace”: false,
“key_whitespace_replacement”: “_”
},
“condition_type”: “none”,
“condition_value”: “”
}
],
“version”: “4.3.12”
}
The corresponding input is configured to receive messages from the wazuh manager. The problem is although the key separator is configured as “.” it appears with “_” in the corresponding stream.
Noting this is the only extractor configured for the input.
2. Describe your environment:
-
OS Information:
Debian 11 -
Package Version:
graylog 4.3.12 -
Service logs, configurations, and environment variables:
3. What steps have you already taken to try and solve the problem?
I have repeated the process of creating the input, extractor, and streams multiple times and tried to restart the input and stream but behavior didn’t change.
4. How can the community help?
Since I am new to graylog I need to find the reason behind this behavior and solve this issue. As I am using graylog to send alerts to the wazuh indexer this issue is causing errors in wazuh modules as it’s learned to parse alerts with “.” as key separator.
Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]
