Extract Json with different log patterns?

deepthi5 — Tue, 15 Nov 2022 16:16:36 GMT

Hi My json logs comes with two different patterns one with timestamp and host added sometimes and one with out these extra fields , when i dont have extra timestamp and host the extractions work better , but for the events with timestamp and host events are not breaking properly

Type 1 Logs

   Component: xxxxx
   Data:
   Description: xxxx
   Message: xxxxx

Accessed URL: xxxx
   Originator: xxxx
   Target: xxxx
   appName: xxxxxx
   subTarget: XYZ
   timeStamp: 1668522719915

Type 2 Logs :

Nov 15 15:31:58 ics021013230.ics-eu-1.asml.com {"appName": "XXXXXXX","Component":"XXXXX","timeStamp":"1668522718900","eventId":"2e0525","Description":"XXXX Gateway: YYYYY ","Originator":"xxxxxx","Target":xxxxx","subTarget":"xxxxx"

Re: Extract Json with different log patterns

richgalloway — Tue, 15 Nov 2022 14:48:02 GMT

What are the props.conf settings for those two sourcetypes? They're very different so they should be separate sourcetypes. Also, the "Type 1" logs are not JSON.

topic Extract Json with different log patterns? in Getting Data In

Extract Json with different log patterns?

Re: Extract Json with different log patterns