how to set TIME_PREFIX for a json file?

[anooshac]

I have a JSON file like this.
{
"ACC_NAME": "A",
"DEPT": [{
"NAME": "D1",
"PROJECT": [{
"P_NAME": "xyz",
"START_DATE": "1/5/2020 5:01:00",
"END_DATE": "1/31/2020 7:21:32",
"STATUS": "PASS"
}]
}]
}
I have been trying to set TIME_PREFIX and it's not working. As you can see there are two dates.When I set TIME_PREFIX= START_DATE i got time stamp error. How can i set TIME_PREFIX so that both the dates are included?

[manjunathmeti · Accepted solution]

Since you are trying to set timestamp for the events, you can try below configuration.

[_json]
INDEXED_EXTRACTIONS = json
KV_MODE = none
AUTO_KV_JSON = false
TIMESTAMP_FIELDS = DEPT.PROJECT.START_DATE

[anooshac]

hi @manjunathmeti , thank you so much!!! It is working, and i am getting all the fields of the json file.

[493669]

Hi @anooshac, try below by escaping special characters-

TIME_PREFIX= \"START_DATE\": \"

[493669]

Also provide Time_format as per your time format is like below-

TIME_FORMAT=%d/%m/%Y %H:%M:%S

[anooshac]

hi i tried that and i'm still getting as "Failed to parse timestamp". How can i include the END_DATE aslo?

[493669]

Timestamp is assigned with only one field either START_DATE or END_DATE .
Can you share your props.conf ? (in code block)

[anooshac]

[_json]
DATETIME_CONFIG =
LINE_BREAKER = ([\r\n]+)
disabled = false
TIME_FORMAT = %m/%d/%Y %H:%M:%S %z
TIME_PREFIX = \"START_DATE\": \"
MAX_TIMESTAMP_LOOKAHEAD = 128
BREAK_ONLY_BEFORE_DATE =

This is props.conf file.

[to4kawa]

LINE_BREAKER = ([\r\n]+)

your JSON is one line?

[anooshac]

hi @to4kawa , no my json is not a one line file.