You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I have a set of data with key value pairs separated by a colon and a whitespace ": ". The whitespace is being ignored, resulting in data being split on a colon. This breaks the data, as it contains timestamps (e.g. 12:34:34).
I have a data set coming into graylog, into a pipeline and then using a rule to extract the field names and data values.
email: firstname.lastname@example.org, event: user login, time: 2018-07-18T08:02:19Z, user_id: 12345
Hello, I'm trying to simulate the bug and noticed another bug.
Using the message in your example:
"email: email@example.com, event: user login, time: 2018-07-18T08:02:19Z, user_id: 12345"
Not only the timestamp gets truncated in the first occurrence of the colon inside the timestamp but also the event gets truncated in the space character, so the event gets mapped to just "user" and the "login" gets lost.
Can you confirm this other bug is also happening in your environment?
Graylog is using CharMatcher from Guava library, that is specially built to work with single characters, not strings.
To solve this, it is required to avoid using the CharMatcher and use directly the Splitter passing strings instead of CharMatcher instances, otherwise if your delimiter strings have multiple characters it would split in any of them and not when all of them matches.