SHOULD_LINEMERGE=false
LINE_BREAKER: (,[\r\n]+\s+){
SECCMD-REMOVEFOOTER = \s}\s+]\s+}
SECCMD-REMOVEHEADER = {\s+"records":\s+[\s+
disabled = false
TIME_PREFIX = "time":\s"
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%Q
MAX_TIMESTAMP_LOOKAHEAD = 800
However, with this Storage Blob data, it appears to be starting mid date/timestamp for time extraction, and I can't figure out why. Here is a sample of data:
{
"records":
[
{
"count": 12,
"total": 0,
"minimum": 0,
"maximum": 0,
"average": 0,
"resourceId": "devicea",
"time": "2018-07-06T08:00:00.0000000Z",
"metricName": "Throughput",
"timeGrain": "PT1M"
}
,
{
"count": 12,
"total": 0,
"minimum": 0,
"maximum": 0,
"average": 0,
"resourceId": "deviceb",
"time": "2018-07-06T08:01:00.0000000Z",
"metricName": "Throughput",
"timeGrain": "PT1M"
}
,
{
... View more