I’m using the JSON extractor in Graylog 2.2.2 to parse a message field containing amongst other JSON, this segment:
"Target" : {"Data" : {"Attribute Flag" : "5","Name" : "CN=Admin,O=Medicine"}}
I have the Key separator character defined as a hyphen.
I have the checkbox checked “Replace whitespace in keys” and have defined a hyphen as the Key whitespace replacement character
When I try the extractor I get (for the above fields):
Target-Data-Attribute Flag
5
Target-Data-Name
CN=Admin,O=Medicine
I expected to get:
Target-Data-Attribute-Flag
with a hyphen between ‘Attribute’ and ‘Flag’
So the extractor tells me it has created ‘Target-Data-Attribute Flag’ for this record which never gets added to the index in Elasticsearch - presumably because the space is not allowed.
This seems to me not to be working as is should. Am I right or have I misunderstood the meaning of the “rep[lace whitespace in keys” functionality?
Tim