Hi I'm trying to use spath to break doen json log, but it duplicates these two fields "time" and "@timestamp" when I create a table! While raw logs show fields that contain only one timestamp!
...
See more...
Hi I'm trying to use spath to break doen json log, but it duplicates these two fields "time" and "@timestamp" when I create a table! While raw logs show fields that contain only one timestamp!
Here is my query:
index="myindex" | spath input=_raw | dedup time | table time _time @timestamp _raw
Here is output:
time _time @timestamp 2023-06-16T12:27:54.907Z 2023-06-18 15:55:30 2023-06-18T12:23:01.109495047Z 2023-06-16T12:27:54.907Z 2023-06-18T12:23:01.109495047Z
here is raw log:
_raw {"server":"mysrv","tags":["_dateparsefailure"],"results":{"statement_id":0},"uniq":"026","@timestamp":"2023-06-18T12:23:01.109495047Z","@version":"1","success":"true","type":"in","http_poller_metadata":{"input":{"http_poller":{"response":{"status_code":200,"headers":{"date":"Sun, 18 Jun 2023 12:27:54 GMT","x-influxdb-build":"OSS","x-request-id":"8cae1609-0dd3-11ee-8ace-005056b7dda2","request-id":"8cae1609-0dd3-11ee-8ace-005056b7dda2","x-influxdb-version":"1.7.8","transfer-encoding":"chunked","content-type":"application/json"},"elapsed_time_ns":4031,"status_message":"OK"},"request":{"retry_count":0,"name":"cpu","host":{"hostname":"logsrv"},"original":{"url":"https://192.168.1.1:8086/query?pretty=true&db=mydb&q=SELECT%20*%20FROM%20%22msg%22%20WHERE%20time%20%3E%20now()%20-%202d%20limit%203600","headers":{"Authorization":"Token mytoken"},"method":"get"}}}}},"time":"2023-06-16T12:27:54.907Z","name":"msg","count":1,"connectionname":"myconnection"}