Hi My json logs comes with two different patterns one with timestamp and host added sometimes and one with out these extra fields , when i dont have extra timestamp and host the extractions work better , but for the events with timestamp and host events are not breaking properly
Type 1 Logs
Component: xxxxx
Data:
Description: xxxx
Message: xxxxx
Accessed URL: xxxx
Originator: xxxx
Target: xxxx
appName: xxxxxx
subTarget: XYZ
timeStamp: 1668522719915
Type 2 Logs :
Nov 15 15:31:58 ics021013230.ics-eu-1.asml.com {"appName": "XXXXXXX","Component":"XXXXX","timeStamp":"1668522718900","eventId":"2e0525","Description":"XXXX Gateway: YYYYY ","Originator":"xxxxxx","Target":xxxxx","subTarget":"xxxxx"
What are the props.conf settings for those two sourcetypes? They're very different so they should be separate sourcetypes. Also, the "Type 1" logs are not JSON.