Hello Team . I need an advice regarding an issue I experience. I have a Heavy Forwarder witch collects data from eventhub with sourcetype mscs:azure:eventhub. On HF level I transform the data from a specific provider to override the sourcetype from mscs:azure:eventhub to mscs:azure:eventhub:databricks.  The format of the logs is json . There is one filed in the logs  properties.requestParams which has the nested key values (depending the log everytime the key is different and not the  same keys for all logs ). The field properties.requestParams  raw format is like "properties.requestParams" : "{\"KeyA\": \"valueA\" , \"keyB\":\"valueB\"}" I want to remove the  double quotes before and after curly braces and the escape character . My challenges are that the sedcmd  works only if I apply it on the HF in props for mscs:azure:eventhub   and not in my new sourcetype  mscs:azure:eventhub:databricks and for some reason it brakes the format from the events with sourcetype mscs:azure:eventhub as well  which I don't want.   Any idea how to approach this issue ?  ... View more

I am trying to undesrtand what the option event_format_flags in  inputs.conf  file can be used for.[mscs_azure_event_hub://<name>] event_format_flags = <integer> The bitwise flags that determines the format of output events ... View more