I don’t know if this is a bug or not, but I’m hoping someone can shed some light on this.
I have a system that is sending large syslog messages into Graylog. I see that Graylog is receiving it and am able to search it in the UI. But since it is not parsing it fully, I was going to create a GROK pattern for it. So under the message field, I select Create extractor for field message | GROK pattern. This brings me to the GROK pattern screen. At this point I want to copy the text from the syslog message field out to the GROK debugger I use. This is where the issue starts.
I select all the text from the message field and paste it into the GROK debugger, (https://grokdebug.herokuapp.com/) but not 100% of the selected text pastes. In fact, it looks like the message size is around 1kb, but only the first approximately 800 bytes of text pastes. I thought this might be a browser issue, (firefox on CentOS7) but if I copy and paste any other browser text from another website, the full text pastes.
So I tried this from my Windows PC and I have the same issue. Only within the Graylog webUI. So I tried a different browser, Edge, and it was the same issue… of the 1kb worth of text, only approximately 800bytes actually transferred when I pasted it into the debugger.
So to eliminate the debugger being the issue, I took the same message text, from the syslog message field, copied it and then pasted it into text editor on linux and notepad on Windows. Both cases only about 800bytes of text out of 1kb pasted.
So it seems that although I am selecting about 1kb worth of text from the message field, only approximately 800b is being copied to the clipboard.
Can anyone think of anything that I can check?
Thanks