Getting Data In

Split json array of objects into multiple events

Path Finder

We have data structured in the following format:

[
  {
    "container_id": "1",
    "executor_id": "1",
    "framework_id": "2",
    "statistics": {
      "cpus_limit": 1,
      "cpus_nr_periods": 1
    },
    "status": {
      "container_id": {
        "value": "123"
      }
    }
  },
   {
    "container_id": "2",
    "executor_id": "1",
    "framework_id": "3",
    "statistics": {
      "cpus_limit": 1.1,
      "cpus_nr_periods": 2
    },
    "status": {
      "container_id": {
        "value": "124"
      }
    }
  }
]

We would like to split it into seperate events in a way that we end up with:

Event 1

 {
        "container_id": "1",
        "executor_id": "1",
        "framework_id": "2",
        "statistics": {
          "cpus_limit": 1,
          "cpus_nr_periods": 1
        },
        "status": {
          "container_id": {
            "value": "123"
          }
        }
      }

Event 2

{
        "container_id": "2",
        "executor_id": "1",
        "framework_id": "3",
        "statistics": {
          "cpus_limit": 1.1,
          "cpus_nr_periods": 2
        },
        "status": {
          "container_id": {
            "value": "124"
          }
        }
      }

We can not do a split by '},' as this would also split on

"cpusnrperiods": }, "status": {

Is there any way we can split those events (on index time)

0 Karma

SplunkTrust
SplunkTrust

Assuming your data isn't actually prettyprinted, you can have LINE_BREAKER = \}(,)\{ in your props.conf, alongside SHOULD_LINEMERGE = false. If your data is prettyprinted you'll need to allow whitespace between the comma and the opening curly brace.

SplunkTrust
SplunkTrust

If your data is prettyprinted you'll need to allow whitespace between the comma and the opening curly brace.

\}(,\s*)\{

Path Finder

It is formatted exactly as I posted. I dont see how the linebreaker would work https://regexr.com/43084. We are not in control of the format as it is a response of a call to a DC/OS api

0 Karma