How to break two lines of JSON read as one event?

devpaymentcloud — Wed, 30 Sep 2020 02:15:20 GMT

Hi,

Currently, I am having hard times to break these 2 JSON lines. They are being read by Splunk as one event. This happens for some type of events (being treated as one)

{"timestamp":"2019-09-05 01:59:50.138","serviceId":"stg-test-serviceID","paymentId":"RCF-C-20190905-0500005984","subServiceId":"stg-test-subServiceID","currencyCode":"JPY","grossAmount":"10000","agencyCode":"testcard","headers":{"x-forwarded-for":"x.x.x.x, 1x.x.x.x","x-forwarded-host":"payment-stg.test.com","connection":"Keep-Alive","via":"1.1 ceba831d448dcb90619d3ded470da482.cloudfront.net (CloudFront)","content-type":"application/x-www-form-urlencoded;charset=UTF-8","x-amzn-trace-id":"Root=1-5d706c16-ba866da04bbbc7b8e10d39c4","x-amz-cf-id":"ejIUaspbrJTfob4bNDQc55OSToFHCg6Wr0LR5SuXgW-4IbszpUnFUw==","content-length":"777","x-forwarded-server":"test-server","true-client-ip":"x.x.x.x","host":"test-stg.test.com","x-forwarded-proto":"https","user-agent":"Java/1.8.0_181 request_id=6t_ct3VepKx7CndjiIWxSv8R0HXpu_hnXfgeGtG24e5yViUBDGIWWA==","accept":"application/json, application/*+json","x-forwarded-port":"443"},"paymentMethodCode":"CARD_TOKEN","order":{"version":1,"email":"credit_dummy@tester.co.jp","ipAddress":"x.x.x.x","items":[{"id":"INVST001","price":"10000","quantity":"1","name":"投信積立"}]},"trackingId":"TRK1909050159501988fCtv"}
{"timestamp":"2019-09-05 01:59:50.651","serviceId":"stg-es-test","paymentId":"AUTO_190905015950649Bsq68niXch3Z05pmi3mreZwzJaD7eO","callbackUrl":"http://localhost","subServiceId":"stg-es-wuaki","custom":"ABCabc123","currencyCode":"EUR","grossAmount":"123","serviceReferenceId":"ABCabc123","agencyCode":"test","headers":{"x-forwarded-for":"x.x.x.x, x.x.x.x","x-forwarded-host":"test-stg.test.com","accept-encoding":"gzip,deflate","connection":"Keep-Alive","via":"1.1 59c75ec1fe1ecd5f3e844673234e9dfc.cloudfront.net (CloudFront)","content-type":"application/x-www-form-urlencoded","x-amzn-trace-id":"Root=1-5d706c16-403958dabc9db68a4f63c2dc","x-amz-cf-id":"00d_4IznNmPvjT4MjHGkmHPEZ8sWcR7eB3QSd59wo4f4IQWDCcRMcA==","content-length":"1433","x-forwarded-server":"test-server","true-client-ip":"x.x.x.x","host":"test-test.com","x-forwarded-proto":"https","user-agent":"Apache-HttpClient/4.1.1 (java 1.5) request_id=a6A9DWJm5DdZHuGq36vsSey9Q1orXuWQfuTGflHnLENWCL1D4K4k6g==","x-forwarded-port":"443"},"paymentMethodCode":"CARD_TOKEN","order":{"version":1,"email":"test@mail.test.com","memberId":"Accept--0-xxxx","ipAddress":"127.0.0.1","shippingAddress":{"name":"ABC漢字abcてすと1213テストÇç","street":"ABC漢字abcてすと1213テストÇç","city":"ABC漢字abcてすと1213テストÇç","state":"ABC漢字abcてすと1213テストÇç","postalCode":"ABab12#$^","phone":"+5511222-3344-55-66","countryCode":"ES"},"items":[{"id":"ABab12#$^","price":"123","quantity":"1","name":"ABC漢字abcてすと1213テストÇç"}]},"trackingId":"TRK1909050159507588Gw8i"}

Currently, my props.conf is set to this:

SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE=^\{\"timestamp\"

I also already tried this setting from the other pages found in this same forum:

 SHOULD_LINEMERGE = false
 LINE_BREAKER = \{\"timestamp
 TIME_PREFIX = timestamp\"\:
 MAX_TIMESTAMP_LOOKAHEAD = 10

But did not work. I also tried to modify LINE_BREAKER and BREAK_ONLY_BEFORE with other types but still not successful.

I am thinking maybe it's because of the log format is different? But it only comes from one source.

topic How to break two lines of JSON read as one event? in Getting Data In

How to break two lines of JSON read as one event?

Re: How to break two lines of JSON read as one event?