My inputs.conf is:
[monitor:///var/log/grains.log]
sourcetype = grains_log
disabled = 0
index = os
My props.conf is as follows:
[grains_log]
INDEXED_EXTRACTIONS = json
KV_MODE = none
But I keep seeing double values.
Does someone has an idea what I miss here ?
↧