Hi, I have difficulty to break a json into multiple events. Here is my log : (appear in one event, instead of 2) {
"InstanceInformationList": [
{
"Version": false,
"PlatformName": "Amazon Linux",
"ComputerName": "ip-10-170-216-17.eu-east-1.compute.internal"
},
{
"PlatformType": "Linux",
"IPAddress": "10.170.216.18",
"AssociationOverview": {
"DetailedStatus": "Failed",
"InstanceAssociationStatusAggregatedCount": {
"Failed": 1,
"Success": 1
}
},
"AssociationStatus": "Failed",
"PlatformVersion": "2",
"ComputerName": "ip-10-170-216-18.eu-east-1.compute.internal",
"InstanceId": "i-00000000001",
"PlatformName": "Amazon Linux"
}
]
} And you can find my props.conf below : [my_test]
SHOULD_LINEMERGE = false
INDEXED_EXTRACTIONS = json
DATETIME_CONFIG = CURRENT
TRUNCATE = 999999
JSON_TRIM_BRACES_IN_ARRAY_NAMES = true
BREAK_ONLY_BEFORE = (\[\s+\{)
MUST_BREAK_AFTER = (\},|\}\s+\])
SEDCMD-remove_header = s/(\{\s+.+?\[)//g
SEDCMD-remove_footer = s/\]\s+\}//g Can you help me to find the write parsing please ? Thank you.
... View more