I have a JSON file like this.
{
"ACC_NAME": "A",
"DEPT": [{
"NAME": "D1",
"PROJECT": [{
"P_NAME": "xyz",
"START_DATE": "1/5/2020 5:01:00",
"END_DATE": "1/31/2020 7:21:32",
"STATUS": "PASS"
}]
}]
}
I have been trying to set TIME_PREFIX and it's not working. As you can see there are two dates.When I set TIME_PREFIX= START_DATE i got time stamp error. How can i set TIME_PREFIX so that both the dates are included?
Since you are trying to set timestamp for the events, you can try below configuration.
[_json]
INDEXED_EXTRACTIONS = json
KV_MODE = none
AUTO_KV_JSON = false
TIMESTAMP_FIELDS = DEPT.PROJECT.START_DATE
Since you are trying to set timestamp for the events, you can try below configuration.
[_json]
INDEXED_EXTRACTIONS = json
KV_MODE = none
AUTO_KV_JSON = false
TIMESTAMP_FIELDS = DEPT.PROJECT.START_DATE
hi @manjunathmeti , thank you so much!!! It is working, and i am getting all the fields of the json file.
Hi @anooshac, try below by escaping special characters-
TIME_PREFIX= \"START_DATE\": \"
Also provide Time_format as per your time format is like below-
TIME_FORMAT=%d/%m/%Y %H:%M:%S
hi i tried that and i'm still getting as "Failed to parse timestamp". How can i include the END_DATE aslo?
Timestamp is assigned with only one field either START_DATE or END_DATE .
Can you share your props.conf ? (in code block)
[_json]
DATETIME_CONFIG =
LINE_BREAKER = ([\r\n]+)
disabled = false
TIME_FORMAT = %m/%d/%Y %H:%M:%S %z
TIME_PREFIX = \"START_DATE\": \"
MAX_TIMESTAMP_LOOKAHEAD = 128
BREAK_ONLY_BEFORE_DATE =
This is props.conf file.
LINE_BREAKER = ([\r\n]+)
your JSON is one line?
hi @to4kawa , no my json is not a one line file.