a really simple json parser is something like:
rule "extract-json"
when
starts_with(to_string($message.message), "{") && ends_with(to_string($message.message), "}")
then
let json = parse_json(to_string($message.message));
let map = to_map(json);
set_fields(map);
end
Not sure why this is not working in your case - from my knowledge it should.
Which Graylog version are you using?