Hi,
this is what im looking for. The problem here is that youre expecting json data. But whats with data thats not JSON? On my installation it throws Pipeline Errors because parse_json requires json content.
2023-05-30 12:23:42,646 WARN : org.graylog.plugins.pipelineprocessor.functions.json.JsonParse - Unable to parse JSON
com.fasterxml.jackson.core.JsonParseException: Unrecognized token ‘connection’: was expecting (‘true’, ‘false’ or ‘null’)
at [Source: (String)“connection from abc () at Sun Jul 10 13:17:22 2005”; line: 1, column: 11]
I can disable Warnings, but to me, this should be not the right way. Im trying to improve and simplify my Ruleset in General. I know that in can use a Regex to seperate my data but then im wondering why is_json cannot do this and whats is_json is for when i already has to sure that i push json data into it.
Best Regards,