Hi I'm trying to use spath to break doen json log, but it duplicates these two fields "time" and "@timestamp" when I create a table! While raw logs show fields that contain only one timestamp!
Here is my query:
index="myindex" | spath input=_raw | dedup time | table time _time @timestamp _raw
Here is output:
time _time @timestamp
2023-06-16T12:27:54.907Z 2023-06-18 15:55:30 2023-06-18T12:23:01.109495047Z
2023-06-16T12:27:54.907Z 2023-06-18T12:23:01.109495047Z
here is raw log:
_raw
{"server":"mysrv","tags":["_dateparsefailure"],"results":{"statement_id":0},"uniq":"026","@timestamp":"2023-06-18T12:23:01.109495047Z","@version":"1","success":"true","type":"in","http_poller_metadata":{"input":{"http_poller":{"response":{"status_code":200,"headers":{"date":"Sun, 18 Jun 2023 12:27:54 GMT","x-influxdb-build":"OSS","x-request-id":"8cae1609-0dd3-11ee-8ace-005056b7dda2","request-id":"8cae1609-0dd3-11ee-8ace-005056b7dda2","x-influxdb-version":"1.7.8","transfer-encoding":"chunked","content-type":"application/json"},"elapsed_time_ns":4031,"status_message":"OK"},"request":{"retry_count":0,"name":"cpu","host":{"hostname":"logsrv"},"original":{"url":"https://192.168.1.1:8086/query?pretty=true&db=mydb&q=SELECT%20*%20FROM%20%22msg%22%20WHERE%20time%20...","headers":{"Authorization":"Token mytoken"},"method":"get"}}}}},"time":"2023-06-16T12:27:54.907Z","name":"msg","count":1,"connectionname":"myconnection"}
