We have .net logs from SeriLog and we would like to break it down into key value pairs at index time and extract some fields.
I have tried to follow the splunk guides and blog posts, but my indexed fields are not available. I can't post links yet unfortunately.
transforms.conf:
[SerilogKVPairs]
DELIMS = "{,}", ":"
[LogLevel]
REGEX = ^(?:[^ \n]* ){3}(?P[^ ]+)
props.conf:
# Extract fields from Serilog log inputs
TRANSFORMS-KVPairs= SerilogKVPairs
TRANSFORMS-LogLevel= LogLevel
fields.conf:
[SerilogKVPairs]
INDEXED=true
[LogLevel]
INDEXED=true
if I search with a pipe to kv SerilogKVPairs it all works, I have searchable values from my Serilog files.
But the fields are not available in the UI unless I pipe it through kv SerilogKVPairs.
We would like them to be available on all logs without having to pipe through the KV command.
Loglevel does not seem to be extracted either.
Is there a log which shows what is going on here?
Thanks
Paul
↧