{"action":"opened","issue":{"url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/2466","repository_url":"https://api.github.com/repos/Graylog2/graylog2-server","labels_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/2466/labels{/name}","comments_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/2466/comments","events_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/2466/events","html_url":"https://github.com/Graylog2/graylog2-server/issues/2466","id":164280829,"number":2466,"title":"Extractor preview doesn't validate field names","user":{"login":"CharlieEriksen","id":1864062,"avatar_url":"https://avatars.githubusercontent.com/u/1864062?v=3","gravatar_id":"","url":"https://api.github.com/users/CharlieEriksen","html_url":"https://github.com/CharlieEriksen","followers_url":"https://api.github.com/users/CharlieEriksen/followers","following_url":"https://api.github.com/users/CharlieEriksen/following{/other_user}","gists_url":"https://api.github.com/users/CharlieEriksen/gists{/gist_id}","starred_url":"https://api.github.com/users/CharlieEriksen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/CharlieEriksen/subscriptions","organizations_url":"https://api.github.com/users/CharlieEriksen/orgs","repos_url":"https://api.github.com/users/CharlieEriksen/repos","events_url":"https://api.github.com/users/CharlieEriksen/events{/privacy}","received_events_url":"https://api.github.com/users/CharlieEriksen/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-07-07T10:44:34Z","updated_at":"2016-07-07T10:44:34Z","closed_at":null,"body":"### Problem description\r\nWhen you create an extractor, it will preview the fields that are being extracted when you try the grok pattern. This should in theory then show what fields will be created.\r\n\r\nSay that you define following grok pattern: %{NUMBER:bytes:int}\r\n\r\nYes, it's bad syntax, since the last : should be a ;. But what you'll observe in the extractor preview, is that it claims to create a field called \"bytes:int\". If you then actually go and index data with this, there'll be no index called \"bytes\", or \"bytes:int\". It will however create a non-int field called \"BASENUM10\".\r\n\r\nThis is rather confusing. I believe the extractor test/preview should point out that you can't have a colon, as an example, in the field name, and you probably meant to use a semi-colon.\r\n\r\n### Steps to reproduce the problem\r\n\r\n1. Create an extractor with this grok pattern: %{NUMBER:bytes:int}\r\n2. Preview the extractor with some data that's just an integer. Note that it shows \"byte:int\" as being an extracted field, and no error\r\n3. Now send more data at this input\r\n4. Observe that no field is created called \"bytes\", or \"bytes:int\", and no error is thrown\r\n\r\nExcepted behaviour would be that in step 2, that it raises an error due to the extracted field not being a valid field name to index, due to the colon.\r\n\r\n### Environment\r\n\r\n* Graylog Version: 2.0.3 OVA\r\n"}}
{"actor":{"display_login":"CharlieEriksen"}}