topic Re: What is the difference between kv_mode=json and kv_mode=none? in Getting Data In

What is the difference between kv_mode=json and kv_mode=none?

chaseto — Tue, 29 Sep 2020 07:55:49 GMT

What will be the end result if we have kv_mode=json versus kv_mode=none in the props.conf? Iff you can explain with an example, that will b e really helpful.

Thank You

Re: What is the difference between kv_mode=json and kv_mode=none?

justinhowe — Thu, 19 Nov 2015 03:42:33 GMT

From the Knowledge Manager Manual:

none: Disables field extraction for the source, source type, or host
identified by the stanza name. You can use this setting to ensure that
other regexes that you have created are not overridden by automatic
field/value extraction for a particular source, source type, or host. You can
also use this setting to increase search performance by disabling
extraction for common but nonessential fields. We have some field
extraction examples at the end of this topic that demonstrate the disabling
of field extraction in different circumstances.

json: Use this setting if you intend to use the field extraction stanza to
extract fields from JSON data.

Re: What is the difference between kv_mode=json and kv_mode=none?

chaseto — Thu, 19 Nov 2015 17:03:51 GMT

Thank You.

Re: What is the difference between kv_mode=json and kv_mode=none?

nawazns5038 — Tue, 29 Sep 2020 18:30:53 GMT

SHOULD_LINEMERGE = false
TIME_FORMAT = %Y-%m-%d %T
TIME_PREFIX = date
MAX_TIMESTAMP_LOOKAHEAD = 30
TRUNCATE = 0
TZ = UTC
NO_BINARY_CHECK=true

KV_MODE = none

LINE_BREAKER = }([\r\n]+|){
INDEXED_EXTRACTIONS = json
AUTO_KV_JSON = false
TRANSFORMS-hostoverriede = hostoverride
EXTRACT-KVPS = (?:args":")?(?<_KEY_1>[^"=]+)=(?:\")?(?<_VAL_1>(\d+|[^\"]+)

I am using that props only in heavy forwarder and the field extraction happening twice . No other props any where else.
What could be the issue ?

Re: What is the difference between kv_mode=json and kv_mode=none?

RBADAMSU — Wed, 10 Oct 2018 21:37:39 GMT

You might be using any kind of field Aliases