We have an object like below.
{ "mirId": "Mule-111", "appVersion": "v1", "businessGroup": "MARKETING", "compress": false, "appName": "dev-sys-netsuite-int-v1", "relational_correlationId": "c96563d1-acb3-11ea-9d9b-0654f1d3f281", "tracePointDescription": "Capture payload", "threadName": "[MuleRuntime].cpuLight.13: [adaptive-logger-test].adaptive-loggerFlow.CPU_LITE @6dbce5f9", "content": { "exception": "", "payload": "https://s3.console.aws.amazon.com/s3/object/unilever-ai-operationalframework/LEVEREDGE/prod/dispatch...", "businessFields": [ { "key": "File_Name", "value": "ASN_200622170087026.xml" }, { "key": "IDOC_NAME", "value": "0000001408187026" } ], "category": "org.unilever.apps.adaptiveloggertest" }, "environment": "TJ-MARKETING-Dev", "LogMessage": "Test-TJ-SCHED", "correlationId": "c98f8110-acb3-11ea-9d9b-0654f1d3f281", "interfaceName": "netsuite-salesapi", "tracePoint": "START", "timestamp": "2020-12-06T13:59:21.133Z" }
Now we need to create a regex for matching the key & value from businessFields array. And the values of "key" , "value" should be stored as multi-value fields. we need to use this regex in transforms.conf for creating indexed-fields.
Have you already tried applying INDEXED_EXTRACTIONS=JSON in your props.conf at your universal forwarder level (or wherever the input is configured)?
Have you already tried applying INDEXED_EXTRACTIONS=JSON in your props.conf at your universal forwarder level (or wherever the input is configured)?
Hi Birbal,
Thank you so much for your support. Your suggestion make my job very cool.