I'm trying to parse the following json input. I'm getting the data correctly indexed but I am also getting a warning.
WARN DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event
{
"events":[
{
"a":"057.00E09037A",
"b":"cdw",
"c":"1.2.7.7",
"d":"192.168.1.0",
"date":"2015-12-14T23:25:24.539Z"
},
{
"a":"057.00E09037A",
"b":"cdw",
"c":"1.2.7.7",
"d":"192.168.1.0",
"date":"2015-12-14T23:25:24.542Z"
}
]
}
Here is the configuration in my props.conf file:
[sample:events]
BREAK_ONLY_BEFORE = ({|[\s+{)
BREAK_ONLY_BEFORE_DATE = false
MUST_BREAK_AFTER = (}|}\s+])
NO_BINARY_CHECK = true
SEDCMD-remove_footer = s/]\s+}//g
SEDCMD-remove_header = s/({\s+.+?[)//g
SEDCMD-remove_trailing_commas = s/},/}/g
category = Custom
disabled = false
pulldown_type = true
Is there something in the props.conf file that I can do to avoid this warning.
... View more
