JSON extractor replacing whitespace in keys


(Tim Shaw) #1

I’m using the JSON extractor in Graylog 2.2.2 to parse a message field containing amongst other JSON, this segment:

"Target" : {"Data" : {"Attribute Flag" : "5","Name" : "CN=Admin,O=Medicine"}}

I have the Key separator character defined as a hyphen.
I have the checkbox checked “Replace whitespace in keys” and have defined a hyphen as the Key whitespace replacement character

When I try the extractor I get (for the above fields):

Target-Data-Attribute Flag
5

Target-Data-Name
CN=Admin,O=Medicine

I expected to get:

Target-Data-Attribute-Flag

with a hyphen between ‘Attribute’ and ‘Flag’

So the extractor tells me it has created ‘Target-Data-Attribute Flag’ for this record which never gets added to the index in Elasticsearch - presumably because the space is not allowed.

This seems to me not to be working as is should. Am I right or have I misunderstood the meaning of the “rep[lace whitespace in keys” functionality?

Tim


(Jochen) #2

Hi Tim,

it looks like this is a bug in the JSON extractor: