JSON events not splitting correctly

[pjohnson1]

I have some data in the following format which does not split correctly.

The events get indexed as one event.

sample data

{"date": "5/8/2020", "time": "7:57:47 AM", "client": "187.45.18.205", "flags": "A", "query": "v1.addthisedge.com"}{"date": "5/8/2020", "time": "7:57:47 AM", "client": "188.35.138.205", "flags": "A", "query": "m.addthis.com"}{"date": "5/8/2020", "time": "7:57:47 AM", "client": "186.95.16.121", "flags": "A", "query": "cloud.acrobat.com"}

props.conf

[monitor:///data/dns/*/*/*/*.json.log]
INDEXED_EXTRACTIONS = json
KV_MODE = none

[to4kawa · Accepted solution]

[monitor:///data/dns/*/*/*/*.json.log]
SHOULD_LINEMERGE = false
LINE_BREAKER = }(\s*)
NO_BINARY_CHECK = true

Well, if you cut it off, there's no problem.

[to4kawa]

your JSON is not valid.
, is missing between objects( {\"date...} )
Both INDEXED_EXTRACTIONS and KV_MODE can't work.

[pjohnson1]

Thank you for answering. I fixed up the json output but still have an issue.

 [{"date": "5/8/2020", "time": "7:57:47 AM", "client": "187.45.18.205", "flags": "A", "query": "v1.addthisedge.com"},{"date": "5/8/2020", "time": "7:57:47 AM", "client": "188.35.138.205", "flags": "A", "query": "m.addthis.com"},{"date": "5/8/2020", "time": "7:57:47 AM", "client": "186.95.16.121", "flags": "A", "query": "cloud.acrobat.com"}]

[to4kawa]

I hope you look my answer before amended.

your json is valid now.

 [monitor:///data/dns/*/*/*/*.json.log]
 INDEXED_EXTRACTIONS = json
 KV_MODE = none

it works.

[pjohnson1]

Yes, I did. Thank you! 🙂