Hi,
I am running into an issue where I have keys and values which will show up once; upon expansion however it shows that there are two values for each key. The only fields that have the two values are under the 'Event' type.
Here is an example of what I see:
and then expanded:
And here is an example souretype configuration that is on one of my forwarders:
[blahblah]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = json
KV_MODE = none
AUTO_KV_JSON = false
NO_BINARY_CHECK = true
TZ = UTC
category = structured
Does anyone have any idea of what is going on?
INDEXED_EXTRACTIONS = json
KV_MODE = none
AUTO_KV_JSON = false
TIME_PREFIX = "timestamp"
MAX_TIMESTAMP_LOOKAHEAD = 50
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TIMESTAMP_FIELDS = timestamp
category = Structured
Try this. i see that the fields are being extracted twice.
Let me know if this works.