I have some json coming in from syslog and there's a bunch of added junk that's inhibiting the field extraction.
I tried
transforms.conf
[eliminate_header]
REGEX=s/^[^{]+//g
DEST_KEY=queue
FORMAT=nullQueue
and
props.conf
[syslog_cue]
TRANSFORMS-t1=eliminate_header
and a couple other things but can't quite seem to get the outcome I want. Testing the regex works, but isn't helping in the way I need it to.
Please provide examples of the original data and the desired output. It's almost impossible to solve regex problems without that.
That said, the REGEX line shown is not valid in transforms.conf. Sed commands are not supported so the regex contains unescaped delimiter characters (slashes).
Additionally, FORMAT=nullQueue discards entire events that match the REGEX, not just the text that matches.
You probably want to use SEDCMD in props.conf.
Please provide examples of the original data and the desired output. It's almost impossible to solve regex problems without that.
That said, the REGEX line shown is not valid in transforms.conf. Sed commands are not supported so the regex contains unescaped delimiter characters (slashes).
Additionally, FORMAT=nullQueue discards entire events that match the REGEX, not just the text that matches.
You probably want to use SEDCMD in props.conf.