What is the difference between kv_mode=json and kv_mode=none?

[chaseto]

What will be the end result if we have kv_mode=json versus kv_mode=none in the props.conf? Iff you can explain with an example, that will b e really helpful.

Thank You

[justinhowe · Accepted solution]

From the Knowledge Manager Manual:

none: Disables field extraction for the source, source type, or host
identified by the stanza name. You can use this setting to ensure that
other regexes that you have created are not overridden by automatic
field/value extraction for a particular source, source type, or host. You can
also use this setting to increase search performance by disabling
extraction for common but nonessential fields. We have some field
extraction examples at the end of this topic that demonstrate the disabling
of field extraction in different circumstances.

json: Use this setting if you intend to use the field extraction stanza to
extract fields from JSON data.

[nawazns5038]

SHOULD_LINEMERGE = false
TIME_FORMAT = %Y-%m-%d %T
TIME_PREFIX = date
MAX_TIMESTAMP_LOOKAHEAD = 30
TRUNCATE = 0
TZ = UTC
NO_BINARY_CHECK=true

KV_MODE = none

LINE_BREAKER = }([\r\n]+|){
INDEXED_EXTRACTIONS = json
AUTO_KV_JSON = false
TRANSFORMS-hostoverriede = hostoverride
EXTRACT-KVPS = (?:args":")?(?<_KEY_1>[^"=]+)=(?:\")?(?<_VAL_1>(\d+|[^\"]+)

I am using that props only in heavy forwarder and the field extraction happening twice . No other props any where else.
What could be the issue ?

[RBADAMSU]

You might be using any kind of field Aliases

[chaseto]

Thank You.