{"action":"created","issue":{"url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/1646","repository_url":"https://api.github.com/repos/Graylog2/graylog2-server","labels_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/1646/labels{/name}","comments_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/1646/comments","events_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/1646/events","html_url":"https://github.com/Graylog2/graylog2-server/issues/1646","id":123497968,"number":1646,"title":"json extractor prefix","user":{"login":"runningman84","id":1699128,"avatar_url":"https://avatars.githubusercontent.com/u/1699128?v=3","gravatar_id":"","url":"https://api.github.com/users/runningman84","html_url":"https://github.com/runningman84","followers_url":"https://api.github.com/users/runningman84/followers","following_url":"https://api.github.com/users/runningman84/following{/other_user}","gists_url":"https://api.github.com/users/runningman84/gists{/gist_id}","starred_url":"https://api.github.com/users/runningman84/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/runningman84/subscriptions","organizations_url":"https://api.github.com/users/runningman84/orgs","repos_url":"https://api.github.com/users/runningman84/repos","events_url":"https://api.github.com/users/runningman84/events{/privacy}","received_events_url":"https://api.github.com/users/runningman84/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Graylog2/graylog2-server/labels/feature","name":"feature","color":"006b75"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-12-22T15:10:24Z","updated_at":"2016-06-17T14:39:28Z","closed_at":null,"body":"Right now you can not add a prefix to the json parser, this means if a json contains fields like timestamp or message the root field is overwritten.\r\n\r\nIn this case the message cannot be written to elasticsearch\r\n```\r\n[0]: index [graylog2_0], type [message], id [20e39820-a8bd-11e5-8ec4-00163e2b2cfe], message [MapperParsingException[failed to parse [timestamp]]; nested: MapperParsingException[failed to parse date field [2015-12-22T15:03:10.353722+0000], tried both date format [yyyy-MM-dd HH:mm:ss.SSS], and timestamp number with locale []]; nested: IllegalArgumentException[Invalid format: \"2015-12-22T15:03:10.353722+0000\" is malformed at \"T15:03:10.353722+0000\"]; ]\r\n```\r\n\r\nThis is the a sample field sensu:\r\n```\r\n{\"timestamp\":\"2015-12-22T15:08:26.058363+0000\",\"level\":\"warn\",\"message\":\"reconnecting to transport\"}\r\n```\r\nWith prefix graylog could create new fields like\r\nsensu_level\r\nsensu_message\r\n...\r\n"},"comment":{"url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/comments/226786835","html_url":"https://github.com/Graylog2/graylog2-server/issues/1646#issuecomment-226786835","issue_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/1646","id":226786835,"user":{"login":"ulope","id":55078,"avatar_url":"https://avatars.githubusercontent.com/u/55078?v=3","gravatar_id":"","url":"https://api.github.com/users/ulope","html_url":"https://github.com/ulope","followers_url":"https://api.github.com/users/ulope/followers","following_url":"https://api.github.com/users/ulope/following{/other_user}","gists_url":"https://api.github.com/users/ulope/gists{/gist_id}","starred_url":"https://api.github.com/users/ulope/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ulope/subscriptions","organizations_url":"https://api.github.com/users/ulope/orgs","repos_url":"https://api.github.com/users/ulope/repos","events_url":"https://api.github.com/users/ulope/events{/privacy}","received_events_url":"https://api.github.com/users/ulope/received_events","type":"User","site_admin":false},"created_at":"2016-06-17T14:39:28Z","updated_at":"2016-06-17T14:39:28Z","body":"This is a really big issue. Our messages _all_ have a `level` field that contains a string level name (e.g. `DEBUG`, `INFO`, etc.)\r\n\r\nProcessing messages like that with the JSON extractor leads to this error: \"[MapperParsingException[failed to parse [level]]; nested: NumberFormatException[For input string: \"INFO\"];]\""}}
{"actor":{"display_login":"ulope"}}