Hi community,
I have a strange issue when i try to parse a JSON :
i have a basic JSON like this with 100 line:
{"id": "0APIClUQ6m77NUk9PVA", "name": "Applications"}
{"id": "0ALB842-DsLmBUk9PVA", "name": "Automatisation Support"}
When i try to index with my props :
[ _json ]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
CHARSET=UTF-8
INDEXED_EXTRACTIONS=json
KV_MODE=none
category=Structured
description=JavaScript Object Notation format. For more information, visit http://json.org/
disabled=false
pulldown_type=true
i got this error message many times :
09-07-2018 08:46:09.039 +0200 ERROR JsonLineBreaker - JSON StreamId:18348078207081945231 had parsing error:Unexpected character while expecting '"': '\\' - data_source="C:\Scripts\Gsuite_Report\teamdrive_settings\2018-09-07_teamdrive_report.json", data_host="DSCRIPT02", data_sourcetype="_json"
09-07-2018 08:46:09.039 +0200 ERROR JsonLineBreaker - JSON StreamId:18348078207081945231 had parsing error:Unexpected character while looking for value: '\\' - data_source="C:\Scripts\Gsuite_Report\teamdrive_settings\2018-09-07_teamdrive_report.json", data_host="DSCRIPT02", data_sourcetype="_json"
can you help me ?
Hi @ serviceinfrastructure,
Can you please try with below props.conf configuration on your Universal Forwarder ?
[yoursourcetype]
INDEXED_EXTRACTIONS = json