topic Re: Indexed time extraction for Pipe Delimited in Getting Data In

Indexed time extraction for Pipe Delimited

renzgujian — Tue, 15 Jun 2021 14:07:39 GMT

Hi guys, I have a monitored CSV file that is Pipe delimited

I was trying to extract the fields so that header1 will be a field header, and that value1 and valueA will be the values extracted under it.
However currently I'm getting 3 events where each line is a single event

I have 2 query,
1) do i have to do a props + transform? or will just a props suffice?
2) Where do I place this props.conf? I see that for Indexed_Extraction i have to put it as UF level?

Sample Logs
header1|header2|header3|header4|header5
value1|value2|value3|value4|value5
valueA||valueC||valueE

Current Props (not working)

[sourcetypeA]
CHARSET=UTF-8
FIELD_DELIMITER=|
HEADER_FIELD_DELIMITER=|
INDEXED_EXTRACTIONS=psv
KV_MODE=none
SHOULD_LINEMERGE=false
category=Structured
disabled=false
pulldown_type=true

Re: Indexed time extraction for Pipe Delimited

venkatasri — Wed, 16 Jun 2021 00:16:54 GMT

Hi @renzgujian

Place the props.conf on UF (forwarder) and restart.

---

An upvote would be appreciated if it helps!

Re: Indexed time extraction for Pipe Delimited

renzgujian — Wed, 16 Jun 2021 11:28:52 GMT

@venkatasri i have tried that, it did not work.
the data did not get ingested when i place the props inside the fwder

inputs @fwder
[monitor:///opt/logs/input.csv]
index=test
sourcetype = test_log
disabled = 0

props @fwder

[test_log]
CHARSET=UTF-8
FIELD_DELIMITER=|
HEADER_FIELD_DELIMITER=|
INDEXED_EXTRACTIONS=psv
KV_MODE=none
SHOULD_LINEMERGE=false
category=Structured
disabled=false
pulldown_type=true