Timestamp Parsing in JSON failed

[sunallen]

Can anyone help me with best configurations for timestamp parsing (where "time" is the actual time) for following JSON format :

{"status":0,"description":"OK","data":{"railway_bloodPressure":[{"ptt":-1.0,"sourceType":"PPG","mean":-1.0,"hr":67.0,"time":"2021-03-09 15:59:00","endTime":"2021-03-09 15:59:00","sys":124.0,"deviceId":"testing","dia":80.0},{"ptt":-1.0,"sourceType":"PPG","mean":-1.0,"hr":71.0,"time":"2021-03-09 16:09:00","endTime":"2021-03-09 16:10:00","sys":-1.0,"deviceId":"testing","dia":-1.0},{"ptt":-1.0,"sourceType":"PPG","mean":-1.0,"hr":69.0,"time":"2021-03-09 16:15:00","endTime":"2021-03-09 16:15:00","sys":127.0,"deviceId":"testing","dia":79.0},{"ptt":-1.0,"sourceType":"PPG","mean":-1.0,"hr":66.0,"time":"2021-03-09 16:25:00","endTime":"2021-03-09 16:26:00","sys":-1.0,"deviceId":"testing","dia":-1.0},{"ptt":-1.0,"sourceType":"PPG","mean":-1.0,"hr":67.0,"time":"2021-03-09 16:35:00","endTime":"2021-03-09 16:35:00","sys":125.0,"deviceId":"testing","dia":81.0},{"ptt":-1.0,"sourceType":"PPG","mean":-1.0,"hr":68.0,"time":"2021-03-09 16:45:00","endTime":"2021-03-09 16:46:00","sys":-1.0,"deviceId":"testing","dia":-1.0},{"ptt":-1.0,"sourceType":"PPG","mean":-1.0,"hr":68.0,"time":"2021-03-09 16:51:00","endTime":"2021-03-09 16:51:00","sys":127.0,"deviceId":"testing","dia":79.0}]}}

I have alrady tried in props.conf...but keep failing...

[richgalloway]

Please share your props.conf settings for that sourcetype.

[sunallen]

My props.conf

DATETIME_CONFIG =
LINE_BREAKER = (.){"ptt
NO_BINARY_CHECK = true
TRUNCATE = 0
category = Custom
disabled = false
pulldown_type = 1
MAX_TIMESTAMP_LOOKAHEAD = 61
TIME_FORMAT = %Y-%m-%dT%T
TIME_PREFIX = \"time\":"(.*?)"
INDEXED_EXTRACTIONS = json

[richgalloway · Accepted solution]

The TIME_PREFIX and TIME_FORMAT settings are incorrect.  Try these.

LINE_BREAKER = (.){"ptt
NO_BINARY_CHECK = true
TRUNCATE = 0
disabled = false
MAX_TIMESTAMP_LOOKAHEAD = 21
TIME_FORMAT = %Y-%m-%d %H:%M:%S
TIME_PREFIX = "time":"
INDEXED_EXTRACTIONS = json

[sunallen]

Thank you.