Hi,
Currently I am having hard times to break these 2 JSON lines. They are being read by splunk as one event. This happens for some type of events (being treated as one)
{"timestamp":"2019-09-05 01:59:50.138","serviceId":"stg-test-serviceID","paymentId":"RCF-C-20190905-0500005984","subServiceId":"stg-test-subServiceID","currencyCode":"JPY","grossAmount":"10000","agencyCode":"testcard","headers":{"x-forwarded-for":"x.x.x.x, 1x.x.x.x","x-forwarded-host":"payment-stg.test.com","connection":"Keep-Alive","via":"1.1 ceba831d448dcb90619d3ded470da482.cloudfront.net (CloudFront)","content-type":"application/x-www-form-urlencoded;charset=UTF-8","x-amzn-trace-id":"Root=1-5d706c16-ba866da04bbbc7b8e10d39c4","x-amz-cf-id":"ejIUaspbrJTfob4bNDQc55OSToFHCg6Wr0LR5SuXgW-4IbszpUnFUw==","content-length":"777","x-forwarded-server":"test-server","true-client-ip":"x.x.x.x","host":"test-stg.test.com","x-forwarded-proto":"https","user-agent":"Java/1.8.0_181 request_id=6t_ct3VepKx7CndjiIWxSv8R0HXpu_hnXfgeGtG24e5yViUBDGIWWA==","accept":"application/json, application/*+json","x-forwarded-port":"443"},"paymentMethodCode":"CARD_TOKEN","order":{"version":1,"email":"credit_dummy@tester.co.jp","ipAddress":"x.x.x.x","items":[{"id":"INVST001","price":"10000","quantity":"1","name":"投信積立"}]},"trackingId":"TRK1909050159501988fCtv"}
{"timestamp":"2019-09-05 01:59:50.651","serviceId":"stg-es-test","paymentId":"AUTO_190905015950649Bsq68niXch3Z05pmi3mreZwzJaD7eO","callbackUrl":"http://localhost","subServiceId":"stg-es-wuaki","custom":"ABCabc123","currencyCode":"EUR","grossAmount":"123","serviceReferenceId":"ABCabc123","agencyCode":"test","headers":{"x-forwarded-for":"x.x.x.x, x.x.x.x","x-forwarded-host":"test-stg.test.com","accept-encoding":"gzip,deflate","connection":"Keep-Alive","via":"1.1 59c75ec1fe1ecd5f3e844673234e9dfc.cloudfront.net (CloudFront)","content-type":"application/x-www-form-urlencoded","x-amzn-trace-id":"Root=1-5d706c16-403958dabc9db68a4f63c2dc","x-amz-cf-id":"00d_4IznNmPvjT4MjHGkmHPEZ8sWcR7eB3QSd59wo4f4IQWDCcRMcA==","content-length":"1433","x-forwarded-server":"test-server","true-client-ip":"x.x.x.x","host":"test-test.com","x-forwarded-proto":"https","user-agent":"Apache-HttpClient/4.1.1 (java 1.5) request_id=a6A9DWJm5DdZHuGq36vsSey9Q1orXuWQfuTGflHnLENWCL1D4K4k6g==","x-forwarded-port":"443"},"paymentMethodCode":"CARD_TOKEN","order":{"version":1,"email":"test@mail.test.com","memberId":"Accept--0-xxxx","ipAddress":"127.0.0.1","shippingAddress":{"name":"ABC漢字abcてすと1213テストÇç","street":"ABC漢字abcてすと1213テストÇç","city":"ABC漢字abcてすと1213テストÇç","state":"ABC漢字abcてすと1213テストÇç","postalCode":"ABab12#$^","phone":"+5511222-3344-55-66","countryCode":"ES"},"items":[{"id":"ABab12#$^","price":"123","quantity":"1","name":"ABC漢字abcてすと1213テストÇç"}]},"trackingId":"TRK1909050159507588Gw8i"}
Currently my props.conf is set to this:
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE=^\{\"timestamp\"
I also already tried this setting from the other pages found in this same forum:
SHOULD_LINEMERGE = false
LINE_BREAKER = \{\"timestamp
TIME_PREFIX = timestamp\"\:
MAX_TIMESTAMP_LOOKAHEAD = 10
But did not work. I also tried to modify LINE_BREAKER and BREAK_ONLY_BEFORE with other types but still not successful.
I am thinking maybe its because of the log format is different? But it only comes from one source.
↧