can't figure out how to indexing my data from zigbee2mgtt. The logs are exported from Home assistance via syslog, as Json.
I have tried various settings in props on the forwarder.
INDEXED_EXTRACTIONS = JSON
category = structured
NO_BINARY_CHECK = true
TIMESTAMP_FIELDS = timestamp
LINE_BREAKER = ([\r\n]+)
disabled = false
pulldown_type = true
And on the search:
KV_MODE = JSON
And this is how the data appears in the log. for me it looks like some kind mix, not just JSON data.
Those props.conf settings should be on a heavy forwarder and/or an indexer. They do no good on a universal forwarder.
If the event is not pure and correct JSON then the INDEXED_EXTRACTIONS=JSON and KV_MODE=_json settings won't work.
As stated in my original reply, the settings go on indexers and/or heavy forwarders. You can put them on search heads, but they won't do any good. Unless, that is, you have a standalone system (combined indexer and search head).