Jochen, If you meant that there are no double quotes around key names -- that's just how shows in the Graylog UI.
The actual JSON returned by my http is like this, perfectly valid. $curl http://int-push-m-core:50590/stats_objs {"objs":{"subs":54,"devs":34}} In the input's configuration, I have: JSON path of data to extract $.objs And as you can see in my original message, this part ("data to extract") seems to work fine too. Or maybe I'm wrong about "that's just how shows in the Graylog UI", and Graylog's "http JSON" input loses double quotes around nested keys? That would be a bug, wouldn't it? -- K On Thursday, August 25, 2016 at 4:22:41 PM UTC+3, Jochen Schalanda wrote: > > Hi Kostya, > > the string {subs=57, devs=34} isn't valid JSON. The JSON extractor will > only work with a valid JSON payload. > > Cheers, > Jochen > > On Thursday, 25 August 2016 15:14:38 UTC+2, Kostya Vasilyev wrote: >> >> Hi, >> >> I'm new to Graylog, so far so good, but ran into an issue trying to use >> the JSON extractor. >> >> I've got an http / JSON input configured, and my data does get picked up >> fine, looks like this in the input's message list: >> >> message >> JSON API poll result: $['objs'] -> {result={subs=57, devs=34}} >> result >> {subs=57, devs=34} >> source >> stats_objs >> timestamp >> 2016-08-25T12:58:49.821Z >> >> Now I'd like to promote the values of "subs" and "devs" into properties >> of each message (event) so I can do charts, etc. >> >> If I go into "New JSON extractor" it picks up an example message, looks >> like below. >> >> Now the issue: >> >> I would expect that the extractor be able to pick up the values of "subs" >> and "devs" and to add those as properties of my messages. >> >> And yet this does not seems to happen, also when I click "Try" on the >> extractor settings screen, I get "Nothing will be extracted". Tried to >> enable flattening, no change. >> >> Am I missing something or does the JSON extractor just plain not work? >> >> Almost sure it's the former, I'm just not doing it right, so what's the >> trick? >> >> Thanks, >> -- K >> >> Example message >> {subs=57, devs=34} >> >> Wrong example? You can load another message. >> Extractor configuration >> Extractor type >> >> JSON >> >> >> >> >> -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/266acfe2-dc5a-45e2-9129-5fb6f5150b31%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
