We are using graylog to process data collected by our network security sensors.
The data is form Zeek, and used to be text fields separated by ‘|’ symbols, we used a pipeline from the marketplace to process all of thesee.
A recent upgrade has converted the logs to JSON. I have created a new input, made a JSON extractor for it, and checked it with the ‘Try’ button. Everything to that point works.
Running the input shows no data, the graylog server.log shows a “mapper_parsing_exception” trying to extract the first JSON field - a timestamp. It’s apparently trying to parse it as a float.
How do I fix this?
