# Unable to extract JSON from log

**URL:** <https://community.graylog.org/t/unable-to-extract-json-from-log/3026>\
**Category:** Graylog Central (peer support)\
**Created:** [November 2, 2017, 2:43pm UTC](https://community.graylog.org/t/unable-to-extract-json-from-log/3026 "2017-11-02T14:43:27Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tnacnud1](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tnacnud1/32/1116_2.png) [@tnacnud1](https://community.graylog.org/u/tnacnud1)\
**Post date:** [November 2, 2017, 2:43pm UTC](https://community.graylog.org/t/unable-to-extract-json-from-log/3026/1 "2017-11-02T14:43:27Z")

</div>

I am having an issue extracting this JSON data:

{haproxy\_clientIP:1.1.1.1,haproxy\_clientPort:47178,haproxy\_dateTime:02/Nov/2017:10:32:03.843,haproxy\_frontendNameTransport:https-in~,haproxy\_backend:backend.com\_version03,haproxy\_serverName:backend2,haproxy\_Tw:0,haproxy\_Tc:0,haproxy\_Tt:7,haproxy\_bytesRead:285,haproxy\_terminationState:–,haproxy\_actconn:1,haproxy\_FrontendCurrentConn:1,haproxy\_backendCurrentConn:0,haproxy\_serverConcurrentConn:0,haproxy\_retries:0,haproxy\_srvQueue:0,haproxy\_backendQueue:0,haproxy\_backendSourceIP:10.3.2.30,haproxy\_backendSourcePort:34006}

I have used the default settings as suggested in the Graylog documentation. When I click “Try” I am provided with a message that “nothing will be extracted”. I’m not sure what I am missing, it seems fairly simple. Would anyone be able to tell me if I am missing something simple here? I’ve provided the configuration below:  
Flatten structure- YES  
Line item seperator= ,  
Key/Value separator= :

Thank you for your time.

---

<div class="post-metadata">

**Author:** ![Mantil](https://avatars.discourse-cdn.com/v4/letter/m/ecd19e/32.png) [@Mantil](https://community.graylog.org/u/Mantil)\
**Post date:** [November 2, 2017, 2:56pm UTC](https://community.graylog.org/t/unable-to-extract-json-from-log/3026/2 "2017-11-02T14:56:00Z")

</div>

I ran into the same problem parsing haproxy logs. Make sure your JSON is formatted correctly. Is that the entire message? mine had prepended something like this “\<134\>Nov 2 09:47:49 haproxy[593]:” before the JSON string. Causing the JSON extractor to fail being it wasn’t in spec. To remedy I had to extract that prepended piece out of the string and use the JSON extractor against the new field and all worked fine. Also running your JSON string through a validator I’m seeing it isn’t conforming to specifications. I’d look at that first. Once your JSON is within within spec it should work great.

---

<div class="post-metadata">

**Author:** ![tnacnud1](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tnacnud1/32/1116_2.png) [@tnacnud1](https://community.graylog.org/u/tnacnud1)\
**Post date:** [November 2, 2017, 3:28pm UTC](https://community.graylog.org/t/unable-to-extract-json-from-log/3026/3 "2017-11-02T15:28:09Z")

</div>

Matt- Thanks a ton. I went through and added a space in the haproxy log-format and it resolved the issue! I really appreciate your quick response and I’ve posted below the proper haproxy log format below in case anyone else runs into this issue:

log-format ‘{“haproxy\_clientIP” :"%ci",“haproxy\_clientPort” :"%cp",“haproxy\_dateTime” :"%t",“haproxy\_frontendNameTransport” :"%ft",“haproxy\_backend” :"%b",“haproxy\_serverName” :"%s",“haproxy\_Tw” :"%Tw",“haproxy\_Tc” :"%Tc",“haproxy\_Tt” :"%Tt",“haproxy\_bytesRead” :"%B",“haproxy\_terminationState” :"%ts",“haproxy\_actconn” :%ac,“haproxy\_FrontendCurrentConn” :%fc,“haproxy\_backendCurrentConn” :%bc,“haproxy\_serverConcurrentConn” :%sc,“haproxy\_retries” :%rc,“haproxy\_srvQueue” :%sq,“haproxy\_backendQueue” :%bq,“haproxy\_backendSourceIP” :"%bi",“haproxy\_backendSourcePort” :"%bp"}’

---

<div class="post-metadata">

**Author:** ![Mantil](https://avatars.discourse-cdn.com/v4/letter/m/ecd19e/32.png) [@Mantil](https://community.graylog.org/u/Mantil)\
**Post date:** [November 2, 2017, 3:38pm UTC](https://community.graylog.org/t/unable-to-extract-json-from-log/3026/4 "2017-11-02T15:38:17Z")

</div>

No problem. If you want to check it out or haven’t seen the post yet I did make a post last week to help people out with just this situation with the log format I put together. If it helps further great. Here is the post link. [HAProxy JSON log shipping WITHOUT nxlog](https://community.graylog.org/t/haproxy-json-log-shipping-without-nxlog/2845?u=mantil)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [November 16, 2017, 3:38pm UTC](https://community.graylog.org/t/unable-to-extract-json-from-log/3026/5 "2017-11-16T15:38:34Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.