We are trying to extract fields during indexing time for JSON format events with .gz file, however, it is not extracting the fields and also not extracting the event time from the json field. Can you please verify and provide working props.conf?
props.conf:
[cc_json]
INDEXED_EXTRACTIONS = json
TIMESTAMP_FIELDS = timestamp
MAX_TIMESTAMP_LOOKAHEAD = 11750
TIME_FORMAT = %Y-%m-%dT%H:%M:%SZ
TZ = UTC
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = False
TRUNCATE = 0
category = Custom
description = JavaScript Object Notation format. For more information, visit http://json.org/
disabled = false
pulldown_type = true
Sample Event:
{"effective_ip":"23.23.23.23","resolver_ip":"23.23.23.23","app_id":4,"app_name":"www.test.com","app_version":5,"fallback_mode":false,"decision_provider_name":"c1_cdn","market_name":"North America","country_name":"United States","region_name":"","state_name":"","asn_id":11111,"asn_name":"AAAA International UU","result":1,"ttl":20,"response":"'www.test.net'","reason_code":"Availability data","context":{"AAAA_object_delivery":{"avail":100,"http_kbps":10282,"http_rtt":19},"AA_cdn":{"avail":100,"http_kbps":10658,"http_rtt":11}},"used_edns":false,"resolver_market_name":"North America","resolver_country_name":"United States","resolver_region_name":"","resolver_state_name":"","resolver_asn_id":20940,"resolver_asn_name":"AAAA International LL","timestamp":"2016-11-01T23:54:37Z"}
↧