How to extract my event in index time using props.conf and transform .conf?
How to extract by event in index time to get expected format?
Actual format:
Tue Sep 26 11:38:08 EDT 2017 name="queue_browse" event_id="" queue_name="queue://DCS00/******" queue_length="1212" messages="ID:414d512044574343533030202020202059c473c8101beaf1,ID:414d512044574343533030202020202059c473c8101beaf2,ID:414d512044574343533030202020202059c473c8101beaf3" earliest_msg="1506093703930" latest_msg="1506337258320"
Expected Format:
Tue Sep 26 11:38:08 EDT 2017 name="queue_browse" event_id="" queue_name="queue://DCS00/******" queue_length="1212" earliest_msg="1506093703930" latest_msg="1506337258320"
↧