# Microsoft365 ExtendedProperties

**URL:** <https://community.graylog.org/t/microsoft365-extendedproperties/26888>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules, key\_value\
**Created:** [December 12, 2022, 6:28pm UTC](https://community.graylog.org/t/microsoft365-extendedproperties/26888 "2022-12-12T18:28:34Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![gianluca-valentini](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gianluca-valentini/32/1592_2.png) [@gianluca-valentini](https://community.graylog.org/u/gianluca-valentini)\
**Post date:** [December 12, 2022, 6:28pm UTC](https://community.graylog.org/t/microsoft365-extendedproperties/26888/1 "2022-12-12T18:28:34Z")

</div>

Hi,  
using Grylog 4.3.7 i’m wrking with Microsoft 365 ingestion log.  
Now the problem is ExtendedProperties like field.  
I use the default json extractor but I have differente valure from input and extracted tag:  
The log value is

> “ExtendedProperties”: [  
> {  
> “Name”: “ResultStatusDetail”,  
> “Value”: “Redirect”  
> },  
> {  
> “Name”: “UserAgent”,  
> “Value”: “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36”  
> },  
> {  
> “Name”: “RequestType”,  
> “Value”: “OAuth2:Authorize”  
> }  
> ]

while the graylog extracted one is

> {Name=ResultStatusDetail, Value=Redirect}, {Name=UserAgent, Value=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36}, {Name=RequestType, Value=OAuth2:Authorize}

So how I can read it? I don’t understand the graylog conversion. It seems a map list but without quotes I cannot distinguish between the string and number values.

Can somebody help me to understand how to manage it?  
Gianluca

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [December 12, 2022, 11:59pm UTC](https://community.graylog.org/t/microsoft365-extendedproperties/26888/2 "2022-12-12T23:59:33Z")

</div>

Hello @gianluca-valentini

Not 100% sure what going on, what does your settings look like on the input,?

---

<div class="post-metadata">

**Author:** ![gianluca-valentini](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gianluca-valentini/32/1592_2.png) [@gianluca-valentini](https://community.graylog.org/u/gianluca-valentini)\
**Post date:** [December 13, 2022, 6:15am UTC](https://community.graylog.org/t/microsoft365-extendedproperties/26888/3 "2022-12-13T06:15:01Z")

</div>

Hi @gsmith  
I have an UDP input  
 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/c/ccec281881717e56e4d983dbf04b4578f3f64e8c.png)

where I add a default Json extractor

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/4/4d343f371de9a79f28b1351a0c6c7383594f995d.png)

So I show you a test message and the extracted ExtendedProperties

> message  
> {“RecordType”:0.0,“UserAgent”:“Microsoft Office OneNote/16.0.5149.1000 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB6; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; WinTSI 06.12.2009;.NET CLR 3.0.30729; .NET4.0C)”,“host”:,“Actor”:,“Target”:,“ModifiedProperties”:[{“Name”:“windiff”,“NewValue”:“nuovo”,“OldValue”:“vecchio”}],“DissectObject”:{“UserObject”:{“id”:“aeng015”}},“Version”:0.0,“ExtendedProperties”:[{“Name”:“ResultStatusDetail”,“Value”:“Redirect”}],“AzureActiveDirectoryEventType”:0.0,“UserType”:0.0,“tags”:[ingestion],“DeviceProperties”:[{“Name”:“nome”,“Value”:1}],“CreationTime”:“2022-11-15T10:26:49”}

> ExtendedProperties  
> {Name=ResultStatusDetail, Value=Redirect}

---

<div class="post-metadata">

**Author:** ![gianluca-valentini](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gianluca-valentini/32/1592_2.png) [@gianluca-valentini](https://community.graylog.org/u/gianluca-valentini)\
**Post date:** [December 15, 2022, 1:55pm UTC](https://community.graylog.org/t/microsoft365-extendedproperties/26888/4 "2022-12-15T13:55:39Z")

</div>

any idea about my problem?

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [December 15, 2022, 10:49pm UTC](https://community.graylog.org/t/microsoft365-extendedproperties/26888/5 "2022-12-15T22:49:12Z")

</div>

Hello, @gianluca-valentini

I really havent worked with JSON extractors and to be honest a pipeline would be a lot better.  
For example this post.

- [Failing JSON Extractor](https://community.graylog.org/t/failing-json-extractor/7944)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [December 29, 2022, 10:49pm UTC](https://community.graylog.org/t/microsoft365-extendedproperties/26888/6 "2022-12-29T22:49:58Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.