Unable to extract JSON from log

(Taylor Duncan) #1

I am having an issue extracting this JSON data:


I have used the default settings as suggested in the Graylog documentation. When I click “Try” I am provided with a message that “nothing will be extracted”. I’m not sure what I am missing, it seems fairly simple. Would anyone be able to tell me if I am missing something simple here? I’ve provided the configuration below:
Flatten structure- YES
Line item seperator= ,
Key/Value separator= :

Thank you for your time.

(Matt) #2

I ran into the same problem parsing haproxy logs. Make sure your JSON is formatted correctly. Is that the entire message? mine had prepended something like this “<134>Nov 2 09:47:49 haproxy[593]:” before the JSON string. Causing the JSON extractor to fail being it wasn’t in spec. To remedy I had to extract that prepended piece out of the string and use the JSON extractor against the new field and all worked fine. Also running your JSON string through a validator I’m seeing it isn’t conforming to specifications. I’d look at that first. Once your JSON is within within spec it should work great.

(Taylor Duncan) #3

Matt- Thanks a ton. I went through and added a space in the haproxy log-format and it resolved the issue! I really appreciate your quick response and I’ve posted below the proper haproxy log format below in case anyone else runs into this issue:

log-format ‘{“haproxy_clientIP” :"%ci",“haproxy_clientPort” :"%cp",“haproxy_dateTime” :"%t",“haproxy_frontendNameTransport” :"%ft",“haproxy_backend” :"%b",“haproxy_serverName” :"%s",“haproxy_Tw” :"%Tw",“haproxy_Tc” :"%Tc",“haproxy_Tt” :"%Tt",“haproxy_bytesRead” :"%B",“haproxy_terminationState” :"%ts",“haproxy_actconn” :%ac,“haproxy_FrontendCurrentConn” :%fc,“haproxy_backendCurrentConn” :%bc,“haproxy_serverConcurrentConn” :%sc,“haproxy_retries” :%rc,“haproxy_srvQueue” :%sq,“haproxy_backendQueue” :%bq,“haproxy_backendSourceIP” :"%bi",“haproxy_backendSourcePort” :"%bp"}’

(Matt) #4

No problem. If you want to check it out or haven’t seen the post yet I did make a post last week to help people out with just this situation with the log format I put together. If it helps further great. Here is the post link. HAProxy JSON log shipping WITHOUT nxlog

(system) closed #5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.