Hi Chris,
It's hard to guess what you are *ing up without the config but it appears
that the enclosing [] might be an issue.
If the JSON payload is all you need then the following could work with
om_tcp:
Exec if $raw_event =~ /\[({.+})\]$/ $raw_event = $1;
Regards,
Botond
On Mon, 4 Aug 2014 13:
Because I'm confused. :-)
Ok, so I got rid of the multiline. Still having issues.
What would be the proper im_out module for NX and input for logstash?
Originally I thought I could do TCP out from NXLog (no conversion) and
"PLAIN" input for Loggstash with "JSON" format. Still fails to parse..
W
On Sun, 3 Aug 2014 12:52:21 -0400
Didjit Charlebois wrote:
> Module xm_multiline
> #2014-07-31T18:59:57-0400
> HeaderLine /^\d\d\d\d.\d\d.\d\dT\d\d:\d\d:\d\d-0400/
> ...
> 2014-08-03T12:23:14-0400[{"open":"2014-08-03T13:00:00.000+","close":"2014-08-04T01:00:00.000+","isOpen":true,
Hi folks, can't get this one right I have a file that contains json
formatted events (example below). I'm having issues with logstash parsing
the message. I've tried different options.
my input reading the file below.
I've tried many options (a few hours worth). Without naming them all, does
