I've a nodejs application which is logging in a text file in JSON format using the winston library.
As you can see from the image, not all log lines are well parsed:
There are 2 logs line that are treated as one, and as a result, splunk is not able to detect the fields in the log lines (level, message ....)
This is my configuration:
[monitor:///home/user/myapp/log] disabled = false index = myindex crcSalt = <SOURCE> sourcetype = json
And this is my log file:
I would recommend taking a sample of your data and brining it in through the GUI. When you do this, you can tweak the Breaking, Timestamping, etc... and see how it effects the way the data will be ingested. You can use the BREAKONLYBEFORE parameter to apply a regex that identifies the beginning of each event.
Once you get the linebreaking correct, save the sourcetype and then start feeding your data in through a forwarder.
Thank you for your answer, but the problem was that the sourcetype was wrong: I wrote json instead o _json, as @ssievert wrote.
Share your sourcetype definition for "json" in props.conf, please.
If you intended to use the built-in sourcetype for json data, that would be "_json".