I'm attempting to extract JSON into multiple events. I've read some other answers and attempted to test configurations using the Add Data feature and tweaking the settings. It seems like from what I'...
See more...
I'm attempting to extract JSON into multiple events. I've read some other answers and attempted to test configurations using the Add Data feature and tweaking the settings. It seems like from what I've read, SHOULD_LINEMERGE should be set to false and there should be a LINE_BREAKER value to identify where to break the lines. Based on the sample data below I think it should break on the associatedItems field. I've attempted to modify + apply different values in the Add Data wizard but it doesn't seem to make a difference.
Any ideas?
This is the source type config I've attempted to use:
[ _json ]
SHOULD_LINEMERGE=false
LINE_BREAKER={"associatedItems"
NO_BINARY_CHECK=true
CHARSET=UTF-8
INDEXED_EXTRACTIONS=json
KV_MODE=none
TRUNCATE=1000000
category=Structured
description=JavaScript Object Notation format. For more information, visit http://json.org/
disabled=false
pulldown_type=true
{
"limit": 1000,
"offset": 0,
"records": [
{
"associatedItems": [
{
"id": "557058:8bc118d1-552f-4613-9b34-c15add9aad17",
"name": "removed58",
"parentId": "10000",
"parentName": "IDP Directory",
"typeName": "USER"
}
],
"category": "user management",
"changedValues": [
{
"changedFrom": "Active",
"changedTo": "Inactive",
"fieldName": "Active / Inactive"
}
],
"created": "2020-03-27T13:27:30.207+0000",
"eventSource": "",
"id": 17808,
"objectItem": {
"id": "557058:8bc118d1-552f-4613-9b34-c15add9aad17",
"name": "removed58",
"parentId": "10000",
"parentName": "IDP Directory",
"typeName": "USER"
},
"summary": "User updated"
},
{
"associatedItems": [
{
"id": "qm:6d90bc78-fd3b-4401-8720-31989454f2b7:5b1d2af1-eb27-4451-8461-575ae3c4a9a5",
"name": "qm:6d90bc78-fd3b-4401-8720-31989454f2b7:5b1d2af1-eb27-4451-8461-575ae3c4a9a5",
"parentId": "10000",
"parentName": "IDP Directory",
"typeName": "USER"
}
],
"authorKey": "testuser",
"category": "user management",
"changedValues": [
{
"changedTo": "Active",
"fieldName": "Active / Inactive"
}
],
"created": "2020-03-27T04:55:07.336+0000",
"eventSource": "",
"id": 17807,
"objectItem": {
"id": "qm:6d90bc78-fd3b-4401-8720-31989454f2b7:5b1d2af1-eb27-4451-8461-575ae3c4a9a5",
"name": "qm:6d90bc78-fd3b-4401-8720-31989454f2b7:5b1d2af1-eb27-4451-8461-575ae3c4a9a5",
"parentId": "10000",
"parentName": "IDP Directory",
"typeName": "USER"
},
"summary": "User created"
},