Hey Ninjas,
I'm getting the below-parsing error when indexing the JSON formatted events.
ERROR LineBreakingProcessor - Line breaking regex has no capturing groups: \"}
Below are the sample JSON events.
{"timestamp":"2018-06-06T19:13:28.459+00:00","message":"Response time for Mongo query {\"method\":\"find\",\"collection\":\"XXXXXXX\",\"query\":{\"$and\":[{\"region.isoCountryCode\":\"GB\"},{\"abc.branchNumber\":5184},{\"classification.category\":{\"$in\":[\"Store\"]}}],\"status.currentStatus\":{\"$ne\":\"Hidden\"}},\"fields\":{}} with offset: 0, limit: 10, fields: {} is 9 ms","className":"XXXXXXXXXX","threadName":"XXXXXXXX","level":"INFO","HOSTNAME":"ip-1-0-0-0","traceId":"XXXXxXXX"}
{"timestamp":"2018-06-05T14:46:53.919+00:00","message":"Response time for request: 2 ms","className":"XXXXXX","threadName":"XXXXXX","level":"INFO","HOSTNAME":"ip-0-0-0-0","traceId":"xxxxxx"}
I have already tried with below props configuration but no luck.
[test1]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
CHARSET=UTF-8
INDEXED_EXTRACTIONS=json
KV_MODE=none
category=Structured
description=JavaScript Object Notation format. For more information, visit http://json.org/
disabled=false
pulldown_type=true
[test2]
BREAK_ONLY_BEFORE=^{
CHARSET=UTF-8
SHOULD_LINEMERGE=true
category=Structured
description=A variant of the JSON source type, with support for nonexistent timestamps
disabled=false
pulldown_type=true
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N
TIME_PREFIX=^{\"timestamp\":\"
[test3]
BREAK_ONLY_BEFORE=^{
CHARSET=UTF-8
SHOULD_LINEMERGE=true
category=Structured
description=A variant of the JSON source type, with support for nonexistent timestamps
disabled=false
pulldown_type=true
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N
TIME_PREFIX=^{\"timestamp\":\"
LINE_BREAKER=\"traceId\":\"[\w\d-]+\"}
Please let me know anyone come across on this issue .....
... View more