For reference: https://github.com/Graylog2/graylog2-server/issues/2751
We will tackle this issue in one of the next releases of Graylog.
Cheers,
Jochen
On Friday, 26 August 2016 13:32:03 UTC+2, Kostya Vasilyev wrote:
>
> Jochen,
>
> On Friday, August 26, 2016 at 1:49:04 PM UTC+3, Jochen Schalanda wrote:
>>
>> Hi Kostya,
>>
>> On Thursday, 25 August 2016 16:02:23 UTC+2, Kostya Vasilyev wrote:
>>>
>>> If you meant that there are no double quotes around key names -- that's
>>> just how shows in the Graylog UI.
>>>
>>
>> No, that's the actual content of the "result" field.
>>
>
>
> This: {subs=57, devs=34} is not valid JSON, I agree.
>
> But this: {"subs": 57, "devs": 34} is valid JSON, this was in the data
> returns by my HTTP API.
>
> Oh, right, it's not just the quotes, it's the "=" vs. ":" key / value
> delimiters.
>
> Sorry I somehow missed it.
>
> But this "string representation of a dictionary" was produced by Graylog's
> "HTTP JSON Input", presumably there is a reason why this format was picked.
>
> And so the issue really is, to take a step back -- how can I work with
> this data (inside "result")?
>
>
>>
>>
>> On Thursday, 25 August 2016 16:02:23 UTC+2, Kostya Vasilyev wrote:
>>>
>>> Or maybe I'm wrong about "that's just how shows in the Graylog UI", and
>>> Graylog's "http JSON" input loses double quotes around nested keys? That
>>> would be a bug, wouldn't it?
>>>
>>
>> The content of the "result" field isn't JSON at all but a string
>> representation of the extracted map/dictionary. If you consider this a bug,
>> please create an issue for this at
>> https://github.com/Graylog2/graylog2-server/issues.
>>
>>
> Before I do that, let me try again, from a broader perspective.
>
> I've got an HTTP API that returns some values as a JSON object.
>
> Then I've configured a "HTTP JSON input" in Graylog, pointing to this HTTP
> API.
>
> As we now know (thanks again), this records the "result" as a string
> that's not JSON, rather it's a "Java toString" or similar, and can't be
> processed with the JSON extractor.
>
> Now the question:
>
> How can extract data from "result" into individual values?
>
> One solution would be to have the input itself do that, using a more
> "specific" JSON selector (path) of the actual (single!) value to extract.
>
> But then I'd need to create essentially same exact inputs for this API,
> one for each value that I need. Not very convenient.
>
> Two possible solutions that I can think of would be:
>
> 1 - Being able to specify several, not one, JSON selectors in an HTTP JSON
> input, and the name of a message property for each one.
>
> Something like this:
>
> _subs = $.objs.subs
> _devs = $.objs.devs
> _db_write_ops = $.db.stats.write.op_count
>
> I guess that's not possible right now?
>
> 2 - Maybe there is an extractor -- not the JSON extractor but some other
> kind -- which already is able to work with what I've got in "result" right
> now?
>
> That would be able to extract the values of "devs" and "subs" and store
> them as message properties?
>
> I can't seem to find one like that, am I missing something?
>
> -- K
>
>
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/e04a1f1f-686e-4850-a42c-3bd0fe2995ae%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
