We are ingesting AWS data through HF and I am seeing duplicate values for each field as shown in screenshot.
Few of the fields shows correct single value but most of the fields have double values.
I have added below settings in props.conf but no luck.
KV_MODE = noneAUTO_KV_JSON = falseINDEXED_EXTRACTIONS = json
INDEXED_EXTRACTIONS = json
Is applied during indexing, in addition to the _raw _time _indextime, host, source and sourcetype field, all fields form the json data in the _raw field is also indexed.There is probably a KV_MODE=auto or json active during search time, so in addition to the indexed fields, the same fields are parsed from the _raw event.