Is anyone using osquery logs with Graylog? I’m having an issue where snapshot queries don’t go through the JSON extractor correctly. I’m ending up with a single field called

snapshot

which contains some kind of key-value string but not valid JSON. e.g.

{backup_age_days=0, backup_date=2018-06-20 00:33:03, device=/dev/disk1s1, encrypted=1, free=360, path=/, pct_free=72, size=500, type=APFS Encryption}