I have slightly modified my props to read the epoch timestamp and weed out the empty events. Hope this helps someone!
SHOULD_LINEMERGE = false
TRUNCATE=100000
TIME_FORMAT = %s
TIME_PREFIX=^
LINE_BREAKER = (\")\d{10}\,
SEDCMD-remove_not_epoch = s/\{?\"\D.*$//g
MAX_TIMESTAMP_LOOKAHEAD = 12
... View more
Just for the benefit of others who are looking for the same, adding this in system/local/times.conf
[all_time]
disabled = 1
[real_time_last30s]
disabled = 1
[real_time_last1m]
disabled = 1
[real_time_last5m]
disabled = 1
[real_time_last30m]
disabled = 1
[real_time_last1h]
disabled = 1
[real_time_all]
disabled = 1
[settings]
show_realtime = false
... View more