# Regular expression + Json Extractor not working? **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [March 25, 2021, 9:49am UTC](https://community.graylog.org/t/regular-expression-json-extractor-not-working/19251 "2021-03-25T09:49:24Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![ixx2i](https://avatars.discourse-cdn.com/v4/letter/i/4491bb/32.png) [@ixx2i](https://community.graylog.org/u/ixx2i)\ **Post date:** [March 25, 2021, 9:49am UTC](https://community.graylog.org/t/regular-expression-json-extractor-not-working/19251/1 "2021-03-25T09:49:24Z")
Hi guys im having some trouble Im triying to extract json from this code, tried default json with default values and nothing seems to happen. ` {"event_type":"Threat_Event","ipv4":"172.16.15.201","hostname":"pruebas1-w10","source_uuid":"cd3e0cd1-05ed-46e6-946d-289aa8208c8b","occured":"25-Mar-2021 08:53:56","severity":"Warning","threat_type":"test file","threat_name":"Eicar","scanner_id":"HTTP filter","scan_id":"virlog.dat","engine_version":"23021 (20210325)","object_type":"file","object_uri":"https://secure.eicar.org/eicar.com","action_taken":"connection terminated","threat_handled":true,"need_restart":false,"username":"PRUEBAS1-W10\\usuario","processname":"C:\\Program Files\\Mozilla Firefox\\firefox.exe","circumstances":"Event occurred during an attempt to access the web.","hash":"3395856CE81F2B7382DEE72602F798B642F14140"}` Im using Graylog v4.0.5+d95b909 I have follwed this post [JSON extractor not working?](https://community.graylog.org/t/json-extractor-not-working/6648) but when I try regex extractor and press try nothing seems to happen, neither error neither extract, any clues? This is how it shows up as imput ![graylog](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/8/8e7dd71f59a22c7bac163657efa740cebc2c478c.png) ---
**Author:** ![maniel](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/maniel/32/58_2.png) [@maniel](https://community.graylog.org/u/maniel)\ **Post date:** [March 25, 2021, 10:29am UTC](https://community.graylog.org/t/regular-expression-json-extractor-not-working/19251/2 "2021-03-25T10:29:00Z")
in my case i used regex extractor to remove some leading bytes that broke json extractor, then i just used json extractor and it works, eset server just sends kinda broken json ---
**Author:** ![ixx2i](https://avatars.discourse-cdn.com/v4/letter/i/4491bb/32.png) [@ixx2i](https://community.graylog.org/u/ixx2i)\ **Post date:** [March 25, 2021, 10:32am UTC](https://community.graylog.org/t/regular-expression-json-extractor-not-working/19251/3 "2021-03-25T10:32:13Z")
my regex extractor wasnt working properly I restarted service and now seems to work, when i did press try nothing would show up so I guess it was bugged out or something. Ty for you response ill try now again ---
**Author:** ![ixx2i](https://avatars.discourse-cdn.com/v4/letter/i/4491bb/32.png) [@ixx2i](https://community.graylog.org/u/ixx2i)\ **Post date:** [March 25, 2021, 10:44am UTC](https://community.graylog.org/t/regular-expression-json-extractor-not-working/19251/4 "2021-03-25T10:44:42Z")
**EDIT:** Tried with `^\uFEFF(\{.*\})` which is the one you shared, but also you said you messed up order, can you share yours if you sill using them ? @maniel **EDIT2:** In the end it ended up working, I used ({.\*}) as regex extractor which i did try before but did not work, unlucky I guess. Regradless, thanks for your help. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [April 8, 2021, 10:45am UTC](https://community.graylog.org/t/regular-expression-json-extractor-not-working/19251/5 "2021-04-08T10:45:15Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.