search

seanthegeek / graylog-fortigate-syslog

A Graylog Content Pack of dashboards for FortiGate syslog data
https://seanthegeek.net/1270/how-to-create-a-single-node-graylog-instance-and-analyze-fortigate-logs/
Apache License 2.0
32 stars 8 forks source link

Legacy Content Pack? #8

Open eronmedeiros opened 11 months ago

eronmedeiros commented 11 months ago

I'm using graylog-server 5.1.5-1 and I tried to import this content pack, but is looks incompatible.

On the web interface it says:

image

Could not import content pack
Error importing content pack, please ensure it is a valid JSON file. Check your Graylog logs for more information.<br /><small>class org.graylog2.contentpacks.model.AutoValue_LegacyContentPack cannot be cast to class org.graylog2.contentpacks.model.ContentPackV1 (org.graylog2.contentpacks.model.AutoValue_LegacyContentPack and org.graylog2.contentpacks.model.ContentPackV1 are in unnamed module of loader 'app')</small>

On the graylog backend logs, it says:

2023-10-05T16:23:57.941-03:00 ERROR [AnyExceptionClassMapper] Unhandled exception in REST resource
java.lang.ClassCastException: class org.graylog2.contentpacks.model.AutoValue_LegacyContentPack cannot be cast to class org.graylog2.contentpacks.model.ContentPackV1 (org.graylog2.contentpacks.model.AutoValue_LegacyContentPack and org.graylog2.contentpacks.model.ContentPackV1 are in unnamed module of loader 'app')
    at org.graylog2.contentpacks.ContentPackPersistenceService.filterMissingResourcesAndInsert(ContentPackPersistenceService.java:131) ~[graylog.jar:?]
    at org.graylog2.rest.resources.system.contentpacks.ContentPackResource.createContentPack(ContentPackResource.java:213) ~[graylog.jar:?]
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:?]
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) ~[?:?]
    at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) ~[?:?]
    at java.lang.reflect.Method.invoke(Unknown Source) ~[?:?]
    at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory.lambda$static$0(ResourceMethodInvocationHandlerFactory.java:52) ~[graylog.jar:?]
    at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:134) ~[graylog.jar:?]
    at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:177) ~[graylog.jar:?]
    at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$ResponseOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:176) ~[graylog.jar:?]
    at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:81) ~[graylog.jar:?]
    at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:478) ~[graylog.jar:?]
    at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:400) ~[graylog.jar:?]
    at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:81) ~[graylog.jar:?]
    at org.glassfish.jersey.server.ServerRuntime$1.run(ServerRuntime.java:255) [graylog.jar:?]
    at org.glassfish.jersey.internal.Errors$1.call(Errors.java:248) [graylog.jar:?]
    at org.glassfish.jersey.internal.Errors$1.call(Errors.java:244) [graylog.jar:?]
    at org.glassfish.jersey.internal.Errors.process(Errors.java:292) [graylog.jar:?]
    at org.glassfish.jersey.internal.Errors.process(Errors.java:274) [graylog.jar:?]
    at org.glassfish.jersey.internal.Errors.process(Errors.java:244) [graylog.jar:?]
    at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:265) [graylog.jar:?]
    at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:234) [graylog.jar:?]
    at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:684) [graylog.jar:?]
    at org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:356) [graylog.jar:?]
    at org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:200) [graylog.jar:?]
    at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:180) [graylog.jar:?]
    at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:?]
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:?]
    at java.lang.Thread.run(Unknown Source) [?:?]

Is there any changes I can do in the json to make it work?

seanthegeek commented 6 months ago

Weird. Try with the latest version of the content pack