in props.conf
[<sourcetypename>]
disabled=false
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)\{\"\w+\"\:
TIME_FORMAT=%Y-%m-%d %H:%M:%S.%3N
TIME_PREFIX=\"message\"\:\"
MAX_TIMESTAMP_LOOKAHEAD=50
TRUNCATE=10000
[http://<token_name>]
disabled = 0
token = ****
index = <index_name>
indexes = <index_name>
queueSize = 4MB
useACK = false
. . .
<appender name="splunkAppender" class="com.splunk.logging.HttpEventCollectorLogbackAppender">
<url>${DATACORE_SPLUNK_URL}</url>
<token>${DATACORE_SPLUNK_TOKEN}</token>
<source>datacore-dal-${SPRING_PROFILES_ACTIVE}</source>
<sourcetype><sourcetypename></sourcetype>
<disableCertificateValidation>true</disableCertificateValidation>
<layout class="ch.qos.logback.classic.PatternLayout">
<pattern>${LOG_PATTERN}</pattern>
</layout>
</appender>
. . .
Message content
{"severity":"WARN","message":"2019-01-19 22:26:47.604 . . . }
... View more
