search

Graylog2 / graylog2-server

Free and open log management
https://www.graylog.org
Other
7.43k stars 1.07k forks source link

Cannot Create Extractor #2422

Closed galebepe closed 8 years ago

galebepe commented 8 years ago

Problem description

Cant create or update extractors.

Steps to reproduce the problem

  1. creating extractor failed Same as https://github.com/Graylog2/graylog2-server/issues/2227 You can see my capture in https://postimg.org/image/9t9y2xydd/

    Environment

    • Graylog Version: 2.0.2
    • Elasticsearch Version:
    • MongoDB Version:
    • Operating System:
    • Browser version:
dennisoelkers commented 8 years ago

Could you please add the relevant parts of your browser's javascript console and your server log?

galebepe commented 8 years ago

Yes, thanks thanks for your help; When the error occurs the log JS in the browser doesn’t shows anything. But the registry shows something ( https://postimg.org/image/4pnfg2iy9/ ). Which log of the server you want? the graylog.log doesn’t show changes....

Thanks again for your help!

joschi commented 8 years ago

@galebepe Please check the logs of the Graylog node for a corresponding error message at that time. You can find them at /var/log/graylog/*.

galebepe commented 8 years ago

thanks for your answer, this is the server log:

2016-06-29_16:22:52.18761 2016-06-29 16:22:52,174 INFO : org.apache.shiro.session.mgt.AbstractValidatingSessionManager - Finished session validation.  No sessions were stopped.
2016-06-29_16:33:52.24599 2016-06-29 16:33:52,242 INFO : org.graylog2.rest.resources.system.inputs.ExtractorsResource - Updated extractor <9c059d10-332c-11e6-ad80-005056aaf299> of type [split_and_index] in input <57585746b30ca7031f35aca7>.
2016-06-29_16:35:24.36954 2016-06-29 16:35:24,367 ERROR: org.graylog2.rest.resources.system.inputs.ExtractorsResource - Cannot create extractor. Missing configuration.
2016-06-29_16:35:24.37099 org.graylog2.ConfigurationException: Parameters cannot be casted.
2016-06-29_16:35:24.37397   at org.graylog2.inputs.extractors.SplitAndIndexExtractor.<init>(SplitAndIndexExtractor.java:57) ~[graylog.jar:?]
2016-06-29_16:35:24.38282   at org.graylog2.inputs.extractors.ExtractorFactory.factory(ExtractorFactory.java:59) ~[graylog.jar:?]
2016-06-29_16:35:24.38286   at org.graylog2.rest.resources.system.inputs.ExtractorsResource.buildExtractorFromRequest(ExtractorsResource.java:343) [graylog.jar:?]
2016-06-29_16:35:24.38287   at org.graylog2.rest.resources.system.inputs.ExtractorsResource.update(ExtractorsResource.java:178) [graylog.jar:?]
2016-06-29_16:35:24.38442   at sun.reflect.GeneratedMethodAccessor163.invoke(Unknown Source) ~[?:?]
2016-06-29_16:35:24.39189   at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_77]
2016-06-29_16:35:24.40578   at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_77]
2016-06-29_16:35:24.41467   at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory$1.invoke(ResourceMethodInvocationHandlerFactory.java:81) [graylog.jar:?]
2016-06-29_16:35:24.41894   at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:144) [graylog.jar:?]
2016-06-29_16:35:24.42941   at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:161) [graylog.jar:?]
2016-06-29_16:35:24.43184   at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$TypeOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:205) [graylog.jar:?]
2016-06-29_16:35:24.44249   at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:99) [graylog.jar:?]
2016-06-29_16:35:24.44382   at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:389) [graylog.jar:?]
2016-06-29_16:35:24.44744   at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:347) [graylog.jar:?]
2016-06-29_16:35:24.45348   at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:102) [graylog.jar:?]
2016-06-29_16:35:24.45761   at org.glassfish.jersey.server.ServerRuntime$2.run(ServerRuntime.java:326) [graylog.jar:?]
2016-06-29_16:35:24.46564   at org.glassfish.jersey.internal.Errors$1.call(Errors.java:271) [graylog.jar:?]
2016-06-29_16:35:24.46915   at org.glassfish.jersey.internal.Errors$1.call(Errors.java:267) [graylog.jar:?]
2016-06-29_16:35:24.47239   at org.glassfish.jersey.internal.Errors.process(Errors.java:315) [graylog.jar:?]
2016-06-29_16:35:24.47366   at org.glassfish.jersey.internal.Errors.process(Errors.java:297) [graylog.jar:?]
2016-06-29_16:35:24.47551   at org.glassfish.jersey.internal.Errors.process(Errors.java:267) [graylog.jar:?]
2016-06-29_16:35:24.47760   at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:317) [graylog.jar:?]
2016-06-29_16:35:24.48427   at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:305) [graylog.jar:?]
2016-06-29_16:35:24.48629   at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:1154) [graylog.jar:?]
2016-06-29_16:35:24.48954   at org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:384) [graylog.jar:?]
2016-06-29_16:35:24.49179   at org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:224) [graylog.jar:?]
2016-06-29_16:35:24.49571   at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:176) [graylog.jar:?]
2016-06-29_16:35:24.49786   at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [?:1.8.0_77]
2016-06-29_16:35:24.49992   at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [?:1.8.0_77]
2016-06-29_16:35:24.50597   at java.lang.Thread.run(Thread.java:745) [?:1.8.0_77]
2016-06-29_17:22:52.17189 2016-06-29 17:22:52,170 INFO : org.apache.shiro.session.mgt.AbstractValidatingSessionManager - Validating all active sessions...
2016-06-29_17:22:52.17884 2016-06-29 17:22:52,171 INFO : org.apache.shiro.session.mgt.AbstractValidatingSessionManager - Validating all active sessions...
2016-06-29_17:22:52.18790 2016-06-29 17:22:52,175 INFO : org.apache.shiro.session.mgt.AbstractValidatingSessionManager - Finished session validation.  No sessions were stopped.
2016-06-29_17:22:52.19735 2016-06-29 17:22:52,176 INFO : org.apache.shiro.session.mgt.AbstractValidatingSessionManager - Finished session validation.  No sessions were stopped.
galebepe commented 8 years ago

Parameters cannot be casted... i try to extract from the message:

<134>Jun 29 14:51:19 zimbra-proxy-prod amavis[21434]: (21434-10) FWD from <gg@xxxx.xxx> -> <rr@xxxx.xxx>,BODY=7BIT 250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 213247A062

with split by

<

Target index

 3

when i do try shows 

gg@xxxx.xxx> ->

the option "Only attemp extraction if field contains string" string "amavis"

THANKS AGAIN!

jalogisch commented 8 years ago

@galebepe you should grep the wanted information with a grok pattern

but in general: We are using GitHub issues for tracking bugs in Graylog itself, but this doesn't look like one. Please post this issue to our public mailing list or join the #graylog channel on freenode IRC.

Thank you!