Json parse error when json sent through postman on gelf

Graylog Central (peer support)
1

Hi Team,

I have a json file as below, i am sending it through gelf.

{
    "message": "test",
    "timestamp": 1523522669364,
    "errorCode": "null",
}

timestamp is unix epoch format. (millis)

I am using the below pipeline rule to convert the timestamp to normal timestamp.

rule "XXX"
when
    has_field("message")
then
    let json = parse_json(to_string($message.message));
    let fields = select_jsonpath(json, {time:"$.timestamp"});
    set_fields(fields);
    let new_time = to_long($message.time);
    set_field("new_time1", new_time / 1000);
    let epoch = parse_date("1970-01-01T00:00:00", "yyyy-MM-dd'T'HH:mm:ss");
    let ts_seconds = seconds(to_long($message.new_time1));
    set_field("timestamp", epoch + ts_seconds);
end

When i simulate the json with the above pipeline, the timestamp is parsing accurately.

But when i send the json through postman on gelf, i am getting the below error in graylog logs.

2018-04-19 10:43:23,635 WARN : org.graylog.plugins.pipelineprocessor.functions.json.JsonParse - Unable to parse json
com.fasterxml.jackson.core.JsonParseException: Unrecognized token 'test': was expecting ('true', 'false' or 'null')
at [Source: iot; line: 1, column: 7]

Could someone help.

Thanks in advance.

Regards,
Vinay.

2

That’s not a valid GELF message. Please refer to http://docs.graylog.org/en/2.4/pages/gelf.html#gelf-payload-specification for details.

The string “test” (without the double quotes) is not a valid JSON structure.

3

can you please give an example valid gelf json

i am sending double qouted text “test” in message

4

I already linked to the GELF specification which includes several example messages.

5

Hi Jochen,

The json is getting indexed now. I am using the below rule.
rule “XXX”
when
has_field(“message”)
then
let json = parse_json(to_string(message.message)); let fields = select_jsonpath(json, {time:".timestamp"});
set_fields(fields);
let new_time = to_long($message.time);
set_field(“new_time1”, new_time / 1000);
let epoch = parse_date(“1970-01-01T00:00:00”, “yyyy-MM-dd’T’HH:mm:ss”);
let ts_seconds = seconds(to_long($message.new_time1));
set_field(“timestamp”, epoch + ts_seconds);
end
The problem is :
Simulator is giving the exact time,
but the indexed data has timestamp as 1970-01-01T00:00:00 (which is not correct)

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.