Why do I have fieldnames in my TSV data

[tkwaller_2]

Hello

I have configured a monitor for our TSV data but I am getting field names in the data. I believe its because I'm using the "FIELD_NAMES" in my props.conf OR its since these are in the file header but Im not exactly sure.

heres my props.conf on my UF

[fp:tsv]
FIELD_DELIMITER = \t
HEADER_FIELD_DELIMITER = \t
INDEXED_EXTRACTIONS = TSV
FIELD_NAMES = <around 100 field names>

My props.conf on indexers:

[fp:tsv]
FIELD_DELIMITER = \t
HEADER_FIELD_DELIMITER = \t
FIELD_NAMES = <around 100 field names>
KV_MODE = none

For example
Field name:
data_authentication

Values:
5.0

7.5
data.score_adjusted

If you click on the value data.score_adjusted in the fields list under the data_authentication it returns the FIELD_NAMES event record.
So I guess my question is 2 part:
1. Is the reason for this because I am using the FIELD_NAMES config in props?
2. Can I fix this by removing that and reindexing? Any other issues that you might see with this?

Thanks for the thoughts
Todd

[tkwaller_2 · Accepted solution]

Answered my own question in testing. Found that removing the FIELD_NAMES part of the stanza did indeed keep field names out of the fields, it seems that in instances where the field was null it populated with field names.

Side Note:
I also fixed timestampping:

[fp:tsv]
FIELD_DELIMITER = \t
HEADER_FIELD_DELIMITER = \t
INDEXED_EXTRACTIONS = TSV
TIMESTAMP_FIELDS = md_createdAt