I have used the default settings as suggested in the Graylog documentation. When I click “Try” I am provided with a message that “nothing will be extracted”. I’m not sure what I am missing, it seems fairly simple. Would anyone be able to tell me if I am missing something simple here? I’ve provided the configuration below:
Flatten structure- YES
Line item seperator= ,
Key/Value separator= :
I ran into the same problem parsing haproxy logs. Make sure your JSON is formatted correctly. Is that the entire message? mine had prepended something like this “<134>Nov 2 09:47:49 haproxy:” before the JSON string. Causing the JSON extractor to fail being it wasn’t in spec. To remedy I had to extract that prepended piece out of the string and use the JSON extractor against the new field and all worked fine. Also running your JSON string through a validator I’m seeing it isn’t conforming to specifications. I’d look at that first. Once your JSON is within within spec it should work great.
Matt- Thanks a ton. I went through and added a space in the haproxy log-format and it resolved the issue! I really appreciate your quick response and I’ve posted below the proper haproxy log format below in case anyone else runs into this issue:
No problem. If you want to check it out or haven’t seen the post yet I did make a post last week to help people out with just this situation with the log format I put together. If it helps further great. Here is the post link. HAProxy JSON log shipping WITHOUT nxlog