Hi all,I am trying to parse multiple nested Multimetric logs as metrics and am failing.The following source type works when I read logs individually, e.g. {"event":"metric","metric_name:my_metric_1":2,"metric_name:my_metric_2":2.1} or pretty printed: { "event": "metric", "metric_name:my_metric_1": 2.0, "metric_name:my_metric_2": 2.1 }[json_metrics_singleevent] SHOULD_LINEMERGE = false INDEXED_EXTRACTIONS = JSON KV_MODE = none ____________________________________________________________________________ in reality, logs look like this: {"data":[{"event":"metric","metric_name:my_metric_1":0,"metric_name:my_metric_2":0.1},{"event":"metric","metric_name:my_metric_1":1,"metric_name:my_metric_2":1.1},{"event":"metric","metric_name:my_metric_1":2,"metric_name:my_metric_2":2.1}]}or pretty printed:{ "data": [ { "event": "metric", "metric_name:my_metric_1": 0.0, "metric_name:my_metric_2": 0.1 }, { "event": "metric", "metric_name:my_metric_1": 1.0, "metric_name:my_metric_2": 1.1 }, { "event": "metric", "metric_name:my_metric_1": 2.0, "metric_name:my_metric_2": 2.1 } ] } Sourcetype: [json_metrics_multievents] SHOULD_LINEMERGE = false INDEXED_EXTRACTIONS = JSON LINE_BREAKER = (\{\"data\"\:\[)|(\,)\{"event|(\]\}) --> doesn't work. I am getting the response, the logs are not properly structured.Can someone help please?
... View more