I want to exclude part of JSON message before indexing. How can I achieve that> Below is a sample JSON. I used SED command in props.conf to exclude the first line and make it only JSON Indexed extraction. And another 2 more SEDs in props.conf to ignore a section of XML message (part of below JSON) as well
How can I write SED to ignore the "ignore" section below?
2019-10-02_09:09:09.234 My JSON message is
{A_message
{"blah": is blah
"blah2": is blah2
"blah3" : {
blah blah blah
}
"Ignore this" :
{
"ignore1": ignore1
ignore2: "ignore2"
}
}
↧