JSON extractor not working in latest version

Graylog Central (peer support)
1

I am unable to extract below json in full_message
{"@timestamp": “”, “date_time”: “22/Jan/2021:13:59:39.246”, “bytes_read”: 3813, “captured_request_cookie”: “-”, “captured_response_cookie”: “-”, “hostname”: “haproxy”, “http_method”: “POST”, “http_path”: “/vulnerabilities/weak_id/”, “http_get_params”: “”, “http_version”: “HTTP/1.1”, “http_user_agent”: “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36”, “http_request_cookies”: “PHPSESSID=m6ov2pjd5r6hjvin6tcgun0ok0; security=low”, “http_request_body”: “-”, “http_request_content_type”: “application\/x-www-form-urlencoded”, “unique_id”: “-”, “status_code”: 200", “http_request_time”: 40, “http_idle_time”: 0, “handshake_time”: 0", “http_receive_time”: , “http_response_time”: , “unix_timestamp”: 1611323979, “bytes_received”: 678, “active_conn”: 1, “backend_name”: “Backend”, “beconn”: 0, “backend_ip”: “127.0.0.5”, “backend_port”: “11324”, “backend_queue”: 0, “src_ip”: “10.10.111.53”, “src_port”: 57538, “frontend_name”: “Listener80”, “feconn”: 1, “frontend_ip”: “127.0.0.5”, “frontend_port”: 10001, “pid”: 18792, “http_request”: “”, “retries”: 0, “request_count”: 38193, “server_name”: “srv1”, “srvconn”: 0, “server_ip”: “172.16.4.49”, “server_port”: "80, “server_queue”: “0”, “termination_state”: “–”, “tags”: “”, “location”: “”, “ctx_tags”: ", “darwin_reputation_error”: 0, “darwin_session_error”: 0, “darwin_user_agent_error”: 0, “darwin_reputation_score”: -1, “darwin_session_score”: -1, “darwin_user_agent_score”: -1, “defender_score”: - }

2

Hi there, and welcome to the community! Before we get too deep into attempting to troubleshoot the issue, please take a moment to read the FAQ/Guidelines. There are some things in there that are pertinent to your issue. Namely:

  • Please ensure you surround any code with ```. This will help make things more readable for the folks who attempt to help
  • What you’ve tried
  • Any errors you’re seeing

While folks in the community are happy to help, simply posting a message saying “this doesn’t work” doesn’t give the community any meaningful way to move forward and help you solve your issue.

1 Like
3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.