Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

json extractor should check for valid lucene keys #2434

profhase opened this issue Jun 29, 2016 · 0 comments

json extractor should check for valid lucene keys #2434

profhase opened this issue Jun 29, 2016 · 0 comments


Copy link

@profhase profhase commented Jun 29, 2016

Problem description

If fieldnames contain spaces, the extractor extracts those fields, but
later in the search those fields are not written/cannot be found, as space is not allowed in lucene fieldnames.

Probable solution

One could just replace any invalid character in fieldnames produced by the json extractor (replace spaces)

Steps to reproduce the problem

  1. send message {"my key": "value"}
  2. Extract it with json extractor (in preview you will see the field extracted
  3. Search for the message and there will be no key 'my key'


  • Graylog Version: 2.0.1-2
  • Elasticsearch Version: 2
  • MongoDB Version: 3
  • Operating System: docker container
  • Browser version: FF 45
@jalogisch jalogisch added bug S2 P3 labels Jul 4, 2016
@jalogisch jalogisch added this to the 2.1.0 milestone Jul 4, 2016
@bernd bernd self-assigned this Jul 14, 2016
edmundoa added a commit that referenced this issue Jul 15, 2016
* Add JSON extractor option to replace whitespace in message keys

Fixes #2434

* Add JSON extractor option to add static prefix to every message key

Fixes #1646

* Disable whitespace replacement input when replacement is disabled

* Modify texts trying to add more context
@kroepke kroepke added the triaged label Sep 21, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

4 participants
You can’t perform that action at this time.