Hi,
We have a simple json extractor -
Configuration
- list_separator: ,
- kv_separator: =
- key_prefix:
- key_separator: .
- replace_key_whitespace:
- key_whitespace_replacement: _
Essentially for our json formatted input syslog message, we want it to be
parsed as follows
message: {"stage":"time","pid":1671865,"user":"xxx","group":"xxxx",
stats":{"elapsed":60.00,"kernel":0.10,"user":0.20}}
stats.elapsed:
stats.kernel
stats.user
etc.
However, the webgui shows an underscore "_" instead of "." for the parsed
field names, so it appears as
stats_elapsed
stats_kernel
stats_user
Question is why is this json extractor not working as intended?
Thanks,
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/24905bf8-532a-48b9-bda0-f3fe24cb225a%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
