Hi Splunkers , I'm collecting logs from S3 through heavy forwarder which are in json format . After indexing i see the logs in below format. i want fields inside the message field to be extracted in...
See more...
Hi Splunkers , I'm collecting logs from S3 through heavy forwarder which are in json format . After indexing i see the logs in below format. i want fields inside the message field to be extracted into individual fields. { [-] @timestamp: 2021-03-08T12:55:42.959Z @version: 1 host: XX.XXX.XXX.XXX message: <171>Mar 08 13:09:22 LOGSTASH[-]: {"@version":"1","facility_label":"zyx","program":"CRON","logtype":"syslog-prod","priority":86,"tags":["_grokparsefailure"],"pid":"1234","vmd_name":"abc","host":"XX.XXX.XXX.XXX","severity":6,"facility":10,"beat":{"name":"zxz"},"@timestamp":"","type":"xyz","timestamp":"Mar 8 13:09:22","logsource":"abc","severity_label":"Informational","message":"abc: session closed for user root\n"} port: 1234 } I have tried the following transforms config at HF and it didn't work: props.conf [aws:s3] TRANSFORMS-xyz= s3-trans transforms.conf [s3-trans] REGEX = [\"|\@](\w+)\":[\s]*([^\,\}]+) FORMAT = $1::$2