Why can't I see all data is received in HEC?

[igor04653]

Hello dear community

Can you please advise me. My team is complaining that not all data comes from the HEC token from Kubernetes.

I don't see any errors in _internal at this index.

But I noticed something interesting in the index="_introspection" there are breaks in the data. Could this be related? And how to fix it?

 

[scelikok]

Hi @igor04653,

HEC inputs expect valid JSON events Please check if you have malformed JSON events from Kubernetes. Sometimes there may be double quotes or { chars that should be escaped.