I have logs coming in that are either straight text (single line) or text with a JSON string as well.
I have no issues with the straight text, but if there is additional JSON, the event breaks on an attribute with a date.
If the JSON has no additional date, it appears to be OK.
Sample log event with JSON
2018-11-28T11:25:32.876+0000 STDIO [INFO] 2018-11-28 11:25:32 [Thread-3-ESWriterBolt] DEBUG BaseBolt - {
"attribute1": 243,
"attribute2": "Standard",
"attribute3": 2018-11-28T13:11:45.3720",
"attribute4": "Y"
}
Everything up to attribute2 reads fine, however, attribute3 starts a new event, timestamped with the date value there, and going until the end, or until potentially another date field.
The current props.conf for this log type just parses a few fields and also includes TRUNCATE = 0 for no truncation of these events.
What additional to I need to setup in props.conf to make this work?
Thanks!
... View more