Hi guys, I have a monitored CSV file that is Pipe delimited
I was trying to extract the fields so that header1 will be a field header, and that value1 and valueA will be the values extracted under it.
However currently I'm getting 3 events where each line is a single event
I have 2 query,
1) do i have to do a props + transform? or will just a props suffice?
2) Where do I place this props.conf? I see that for Indexed_Extraction i have to put it as UF level?
Sample Logs
header1|header2|header3|header4|header5
value1|value2|value3|value4|value5
valueA||valueC||valueE
Current Props (not working)
[sourcetypeA]
CHARSET=UTF-8
FIELD_DELIMITER=|
HEADER_FIELD_DELIMITER=|
INDEXED_EXTRACTIONS=psv
KV_MODE=none
SHOULD_LINEMERGE=false
category=Structured
disabled=false
pulldown_type=true
Hi @renzgujian
Place the props.conf on UF (forwarder) and restart.
---
An upvote would be appreciated if it helps!
@venkatasri i have tried that, it did not work.
the data did not get ingested when i place the props inside the fwder
inputs @fwder
[monitor:///opt/logs/input.csv]
index=test
sourcetype = test_log
disabled = 0
props @fwder
[test_log]
CHARSET=UTF-8
FIELD_DELIMITER=|
HEADER_FIELD_DELIMITER=|
INDEXED_EXTRACTIONS=psv
KV_MODE=none
SHOULD_LINEMERGE=false
category=Structured
disabled=false
pulldown_type=true