I have not got around to getting the timestamp working. I was just using the index time as being good enough. I think TIMESTAMP_FIELDS needs to go in the props.conf on the indexer rather than the forwarder but not sure. ... View more

I have been struggling with the same problem and finally got it to work. The first thing I did was to modify the default xdasconfig.properties file for the layout.ConversionPattern to not put the syslog level and time stamp and to only output the json event. log4j.appender.R.layout.ConversionPattern=%m%n I found through searching many posts that INDEXED_EXTRACTIONS do NOT work on indexers. INDEXED_EXTRACTIONS are applied on forwarders. From what I can tell this is something that changed in version 6. Once I put the following in the props.conf file Universal Forwarder which has the xdas log file local it started working like a charm. props.conf on Universal Forwarder [xdas] INDEXED_EXTRACTIONS = json detect_trailing_nulls = auto SHOULD_LINEMERGE = false Finally, modify the props.conf file on the indexer to not perform search time indexing otherwise the fields will appear to be duplicated. props.conf on the indexer [xdas] KV_MODE = none AUTO_KV_JSON = false Hope this helps! ... View more