Hi,
I have logs format like :
{"guid": "ABC", "type": "email", "value": "email", "session": "sessioid", "service": "HTTP", "created": "2019-11-07T22:41:28.682+00:00", "remote_host": "ip"}
I want to get the timestamp for indexing based on "created" field and want tp show it during search results under _time.
I used the below props.conf :
[sourcetype]
TIME_PREFIX = "created":\s"
KV_MODE=JSON
INDEXED_EXTRACTIONS=JSON
TZ=UTC
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N%z
MAX_TIMESTAMP_LOOKAHEAD = 1000
But its not working. Please guide.
Thanks,
You can try just using TIMESTAMP_FIELDS, ignore other attributes (TIME_PREFIX, TZ, TIME_FORMAT, MAX_TIMESTAMP_LOOKAHEAD). And also attribute KV_MODE is not required during indexed time field extractions.
[sourcetype]
INDEXED_EXTRACTIONS = json
KV_MODE = none
TIMESTAMP_FIELDS = created
Tried this too. But same response.
Tried changing the entries to :
TIME_PREFIX=\"created\":\s\"
KV_MODE=JSON
INDEXED_EXTRACTIONS=JSON
TZ=UTC
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N%:z
MAX_TIMESTAMP_LOOKAHEAD = 100
as well as :
TIME_PREFIX="created":\s"
KV_MODE=JSON
INDEXED_EXTRACTIONS=JSON
TZ=UTC
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N%:z
MAX_TIMESTAMP_LOOKAHEAD = 100
and
TIME_PREFIX=\"created\":\s\"
KV_MODE=JSON
INDEXED_EXTRACTIONS=JSON
TZ=UTC
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N%z
MAX_TIMESTAMP_LOOKAHEAD = 100
None of the above worked.
Try TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N%:z
Tried it. But same response.
Have you tried escaping the quotation marks in your TIME_PREFIX ?
TIME_PREFIX = \"created\":\s\"
Tried it. Same response.