I am using the manual batching example from the docs.
I am sending the following data to the logger.send function:
const obj = {
oid: 'bluesun',
tid: 'transaction_id',
type: 'error',
msg: 'I broke something bad'
}
this.logger.send({
message: obj,
metadata: {
source: 'awsBot',
sourcetype: 'event-bus'
},
severity: 'error'
})
However, none of the fields in the json object appear to be parsed when coming into splunk.
This index is shared by other services that are logging in other formats so we can't override the entire index to expect json formatted messages, but is there a way to force these messages from this source to be parsed as json?
