I am able to parse timestamp and line break at "activity_type" using below settings, however facing challenge in removing the first lines and last lines and also i am not able to extract field/values...
See more...
I am able to parse timestamp and line break at "activity_type" using below settings, however facing challenge in removing the first lines and last lines and also i am not able to extract field/values i used TRANSFORMS still didn't work.
First lines:
{
"status": 0,
"message": "Request completed successfully",
"data": [
{
last lines:
"count": 33830,
"meta_info": {
"total_rows": 33830,
"row_count": 200,
"pagination": {
"pagination_id": ""
}
}
}
Current props.conf and transforms.conf
Props.
[sample_test]
BREAK_ONLY_BEFORE = \"activity_type":\s.+,
DATETIME_CONFIG =
LINE_BREAKER = \"activity_type":\s.+,
MAX_TIMESTAMP_LOOKAHEAD = 16
NO_BINARY_CHECK = true
TIME_FORMAT = %Y-%m-%dT%H:%M:%S
TIME_PREFIX = event_time
TZ = Europe/Istanbul
category = Custom
disabled = false
pulldown_type = true
TRANSFORMS-extraction = extract_field_value
BREAK_ONLY_BEFORE_DATE =
SHOULD_LINEMERGE = true
Transforms.
[extract_field_value]
REGEX = "([^"]+)":\s*"([^"]+)"
FORMAT = $1::$2