Command ldapsearch and collect to index data

[bmarona]

Hello Everyone,

I need help because I have issues with collect command and with data from LDAP (collected with ldapsearch command).
My goal is to collect data from ldap with command "| ldapsearch domain=default search="(&(objectClass=user))" attrs="<attribute_list>" " and index it in "ldapdata" index. For this purpose I wanted to use collect command "| collect index=ldapdata sourcetype=ldap".
From ldapsearch i get events:
_raw1 = {JSON 1}
_raw2 = {JSON 2}
_raw3 = {JSON 3}
.
.
.
_rawN = {JSON N}

After collect command I get this events as one big event in ldap index ($ is end of line):
_raw1 = {JSON 1}${JSON 2}${JSON 3}$...{JSON N}$

Can somebody advise solution on how to index mentioned data in the index as separated JSON events?

Thanks for your help!

[scelikok]

Hi @bmarona,

If you put a table for the attribute_fields command before collect, you will have separate events. Please try the below sample; 

| ldapsearch domain=default search="(&(objectClass=user))" attrs="<attribute_list>" 
| table <attribute_list> 

If this reply helps you an upvote is appreciated.

[bmarona]

@scelikokThanks for the quick answer, tricks with table works - so there is no way to ingest it as JSON?

[scelikok]

@bmarona,

You can use table for _raw field.

| ldapsearch domain=default search="(&(objectClass=user))" attrs="<attribute_list>" 
| table _raw 

If this reply helps you an upvote is appreciated.

[bmarona]

@scelikokUnfortunately | table _raw doesn't work - it still connects events into one big event. So I believe I need to stick to a table version of attributes which is much worse in regards to readability.