diff --git a/graylog2-server/src/main/java/org/graylog2/plugin/Message.java b/graylog2-server/src/main/java/org/graylog2/plugin/Message.java index 9a12cc6426aa5..60bab2e01b8c1 100644 --- a/graylog2-server/src/main/java/org/graylog2/plugin/Message.java +++ b/graylog2-server/src/main/java/org/graylog2/plugin/Message.java @@ -19,6 +19,7 @@ import com.codahale.metrics.Meter; import com.eaio.uuid.UUID; import com.fasterxml.jackson.databind.ObjectMapper; +import com.github.joschi.jadconfig.Parameter; import com.google.common.base.Function; import com.google.common.base.Joiner; import com.google.common.base.Objects; @@ -299,6 +300,9 @@ public class Message implements Messages, Indexable { private static final IdentityHashMap, Integer> classSizes = Maps.newIdentityHashMap(); + @Parameter(value = "replace_dots_in_field_names") + private boolean replaceDotsInFieldNames = true; + static { classSizes.put(byte.class, 1); classSizes.put(Byte.class, 1); @@ -402,9 +406,10 @@ public Map toElasticSearchObject(ObjectMapper objectMapper, @Non } final Object value = entry.getValue(); - // Elasticsearch does not allow "." characters in keys since version 2.0. + // Elasticsearch does not allow "." characters in keys from versions 2.0 to 5.0 (excluded). // See: https://www.elastic.co/guide/en/elasticsearch/reference/2.0/breaking_20_mapping_changes.html#_field_names_may_not_contain_dots - if (key.contains(".")) { + // See: https://www.elastic.co/guide/en/elasticsearch/reference/5.0/release-notes-5.0.0.html#enhancement-5.0.0 + if (key.contains(".") && replaceDotsInFieldNames) { final String newKey = key.replace('.', KEY_REPLACEMENT_CHAR); // If the message already contains the transformed key, we skip the field and emit a warning. diff --git a/graylog2-web-interface/src/components/extractors/extractors_configuration/JSONExtractorConfiguration.jsx b/graylog2-web-interface/src/components/extractors/extractors_configuration/JSONExtractorConfiguration.jsx index 85299adda73ca..403e3e72f7be2 100644 --- a/graylog2-web-interface/src/components/extractors/extractors_configuration/JSONExtractorConfiguration.jsx +++ b/graylog2-web-interface/src/components/extractors/extractors_configuration/JSONExtractorConfiguration.jsx @@ -100,6 +100,13 @@ const JSONExtractorConfiguration = createReactClass({ return this.state.trying || !this.props.exampleMessage; }, + _keySeparatorError(separator) { + if (separator.includes(".")) + return "Warning: Elasticsearch does not allow '.' in field names from version 2.0 up to 5.0 (excluded)" + else + return null + }, + render() { return (
@@ -129,6 +136,7 @@ const JSONExtractorConfiguration = createReactClass({ defaultValue={this.state.configuration.key_separator} required onChange={this._onChange('key_separator')} + error={this._keySeparatorError(this.state.configuration.key_separator)} help={What string to use to concatenate different keys of a nested JSON object (only used if not flattened).} />