Parsing Multimetric Logs

[grexo94]

Hi all,I am trying to parse multiple nested Multimetric logs as metrics and am failing.The following source type works when I read logs individually, e.g.

{"event":"metric","metric_name:my_metric_1":2,"metric_name:my_metric_2":2.1}

or pretty printed:

{
      "event": "metric",
      "metric_name:my_metric_1": 2.0,
      "metric_name:my_metric_2": 2.1
    }[json_metrics_singleevent]
SHOULD_LINEMERGE = false
INDEXED_EXTRACTIONS = JSON
KV_MODE = none

____________________________________________________________________________
in reality, logs look like this:
{"data":[{"event":"metric","metric_name:my_metric_1":0,"metric_name:my_metric_2":0.1},{"event":"metric","metric_name:my_metric_1":1,"metric_name:my_metric_2":1.1},{"event":"metric","metric_name:my_metric_1":2,"metric_name:my_metric_2":2.1}]}or pretty printed:{
  "data": [
    {
      "event": "metric",
      "metric_name:my_metric_1": 0.0,
      "metric_name:my_metric_2": 0.1
    },
    {
      "event": "metric",
      "metric_name:my_metric_1": 1.0,
      "metric_name:my_metric_2": 1.1
    },
    {
      "event": "metric",
      "metric_name:my_metric_1": 2.0,
      "metric_name:my_metric_2": 2.1
    }
  ]
}

Sourcetype:

[json_metrics_multievents]
SHOULD_LINEMERGE = false
INDEXED_EXTRACTIONS = JSON
LINE_BREAKER = (\{\"data\"\:\[)|(\,)\{"event|(\]\})

--> doesn't work. I am getting the response, the logs are not properly structured.Can someone help please?

[VatsalJagani · Accepted solution]

@grexo94 - Basically, I think the problem you have is with JSON List. There are two approaches that I could think of from which you can start:

• HEC
  • If you are already using HEC for data ingestion, OR If you have ingestion flexibility on how you ingest data, and you can convert existing ingestion into a HEC data sending script
  • In this case, you can basically programatically handle JSON List properly to put each entry in its own event and send it to Splunk individually into a separate metric event.
  • https://help.splunk.com/en/splunk-enterprise/get-data-in/metrics/9.2/get-metrics-data-in/get-metrics...
• Ingest Processor
  • If you don't have flexibility in ingestion, you can use the Ingest Processor of Splunk to convert JSON List into individual JSON events (metrics) to be ingested separately.
  • https://lantern.splunk.com/Platform_Data_Management/Transform_Pipelines/Using_Ingest_Processor_to_co...

I hope this helps!!! 

[grexo94]

thank you, yes, these will be my plan b & c's.

I was wondering why i simply cannot use a linebreaker the way i am used to for event-indexing, but i simply accept that for logs that i want to index as metrics