The documentation is EXTREMELY misleading in this regard. There is no such thing as creating a sourcetype . All possible sourcetype values "already exist" in any meaningful sense of the word exist . There is NOTHING that must be done to create one before using it. Just use it and poof it now exists and works.
This is not the right way to do it, however, assuming there is no nesting and no arrays in your JSON, you can get away with doing this:
Settings -> Fields -> Field Transformations -> New Field Transformation then
Set Name to something like <YourSourcetype>_JSONpayload .
Set Type to regex-based .
Set Regular expression to (?<=[,{])"([^"]+)":"([^"]*) .
Set Format to $1::$2 .
Set Create multivalued fields to checked (e.g. true / yes ).
Click green Save button.
Settings -> Fields -> Field Extractions -> New Field Extraction then:
Set Name to <YourSourcetype>_JSONpayload .
Set Apply to to Sourcetype + named = <YourSourcetype> .
Set Type to Uses transform .
Set Extraction/Transform to <YourSourcetype>_JSONpayload .
Click green Save button.
... View more
