We have a sevone network monitoring a JSON data time field formatted as EPOCH in Scientific Notation format. All the examples do not show how to take into account for Scientific Notation. Any assistance would be appreciated. time=1.539895001846788E9
We currently have this setup for DATETIME_CONFIG=CURRENT but then all the events are off and it looks like they are being batch loaded every 4 hours in the search time line.
raw data in filesystem log file. Using inputs.conf with props.conf on the UF on the syslog servers:
{"deviceId":2911,"deviceName":"SS-L1-AGNEW-2","deviceIp":"10.10.14.68","peerId":5,"objectId":227468,"objectName":"Ethernet1/30","objectDesc":"Ethernet1/30","pluginId":1,"pluginName":"SNMP Poller","indicatorId":1420925,"indicatorName":"s1_TotalErrors","format":0,"value":"0.0","**time**":**_1.539895001846788E9_**,"clusterName":"NMS","peerIp":"10.10.30.46"}
I have in props.conf TIME_PREFIX=\"time\": , but I have not found any entry for TIME_FORMAT that works.
If this will not work for PROPS, any suggestions on how to get the correct time for indexing would be appreciated.
TY
