Hello dear community
Can you please advise me. My team is complaining that not all data comes from the HEC token from Kubernetes.
I don't see any errors in _internal at this index.
But I noticed something interesting in the index="_introspection" there are breaks in the data. Could this be related? And how to fix it?
Hi @igor04653,
HEC inputs expect valid JSON events Please check if you have malformed JSON events from Kubernetes. Sometimes there may be double quotes or { chars that should be escaped.