How to export events as JSON format?

[sutom]

Hi All,

I am trying to export events in JSON format, and I am able to do it, and getting events like the one below.

{"preview":false,"result":{"_raw":"{\"tomLogs\":[{\"component\":\"tom\"}]}}}
{"preview":false,"result":{"_raw":"{\"tomLogs\":[{\"component\":\"tom\"}]}}}
{"preview":false,"result":{"_raw":"{\"tomLogs\":[{\"component\":\"tom\"}]}}}

But the My expectation of having these events in an array with commas separated like the below format.

[
{"preview":false,"result":{"_raw":"{\"tomLogs\":[{\"component\":\"tom\"}]}}},
{"preview":false,"result":{"_raw":"{\"tomLogs\":[{\"component\":\"tom\"}]}}},
{"preview":false,"result":{"_raw":"{\"tomLogs\":[{\"component\":\"tom\"}]}}}
]

Please provide some references that can help to export events in the expected format.

[VatsalJagani]

@sutom - I would say the export is correct, add the [ (square brackets) and , (commas) in the exported file manually by regex replace in any advance text/code editor.

This would be the simplest option to what you want to achive. You can also write a small python script to do that we well.

I hope this helps!!!

[yuanliu]

The question is really "how to export events as JSON array."  Is this correct?  The result you got are a sequence of perfectly correct JSON events.

If you want all those events exported to one big array, why not put all events in one big array?  Like

| stats values(_raw) as jumbo_raw

The export will then look like

{"preview":false,"result":{"_raw":[
{"tomLogs":[{"component":"tom"}]},
{"tomLogs":[{"component":"tom"}]},
{"tomLogs":[{"component":"tom"}]}
]}
}

 Will this array do? Otherwise you can write a simple script to convert a series of JSON objects into a JSON array.

[FelixLeh]

Have you tried using "KV_MODE = json" in props.conf where the corresponding Sourcetype is defined?

[your_sourcetype]
KV_MODE = json
#your other settings for the sourcetype: