Hello Team . I need an advice regarding an issue I experience.
I have a Heavy Forwarder witch collects data from eventhub with sourcetype mscs:azure:eventhub.
On HF level I transform the data from a specific provider to override the sourcetype from mscs:azure:eventhub to mscs:azure:eventhub:databricks.
The format of the logs is json .
There is one filed in the logs properties.requestParams which has the nested key values (depending the log everytime the key is different and not the same keys for all logs ).
The field properties.requestParams raw format is like "properties.requestParams" : "{\"KeyA\": \"valueA\" , \"keyB\":\"valueB\"}"
I want to remove the double quotes before and after curly braces and the escape character .
My challenges are that the sedcmd works only if I apply it on the HF in props for mscs:azure:eventhub
and not in my new sourcetype mscs:azure:eventhub:databricks and for some reason it brakes the format from the events with sourcetype mscs:azure:eventhub as well which I don't want.
Any idea how to approach this issue ?
