Hi,
We have a simple json extractor -
Configuration
- list_separator: ,
- kv_separator: =
- key_prefix:
- key_separator: .
- replace_key_whitespace:
- key_whitespace_replacement: _
Essentially for our json formatted input syslog message, we want it to be
parsed as follows
message: {"stage":"time","pid":1671865,"user":"xxx","group":"xxxx",
stats":{"elapsed":60.00,"kernel":0.10,"user":0.20}}
stats.elapsed:
stats.kernel
stats.user
etc.
However, the webgui shows an underscore "_" instead of "." for the parsed
field names, so it appears as
stats_elapsed
stats_kernel
stats_user
Question is why is this json extractor not working as intended?
Thanks,
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/24905bf8-532a-48b9-bda0-f3fe24cb225a%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
