Hi,
I have a sample json file where I have to index the time. I created the stanza at props.conf.
{"readIOps":0.0,"writeIOps":0.0,"otherIOps":0.0,"combinedIOps":0.0,"readThroughput":0.0,"writeThroughput":0.0,"combinedThroughput":0.0,"readResponseTime":0.0,"writeResponseTime":0.0,"combinedResponseTime":0.0,"volumeId":"0200000060080E500029094000009209525E8C08","volumeName":"VC-g0003v0011-H2","readPhysicalIOps":0.0,"writePhysicalIOps":0.0,"observedTime":"2015-07-25T22:07:34.000+0000"}
{"readIOps":0.0,"writeIOps":0.0,"otherIOps":0.0,"combinedIOps":0.0,"readThroughput":0.0,"writeThroughput":0.0,"combinedThroughput":0.0,"readResponseTime":0.0,"writeResponseTime":0.0,"combinedResponseTime":0.0,"volumeId":"0200000060080E500029094000009494525EB56B","volumeName":"dp0012v0044","readPhysicalIOps":0.0,"writePhysicalIOps":0.0,"observedTime":"2015-07-25T22:07:34.000+0000"}
[santa-banta]
**INDEXED_EXTRACTIONS = json**
TIME_PREFIX = "observedTime\":\"
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N+%4N
**MAX_TIMESTAMP_LOOKAHEAD =
LINE_BREAKER =**
SHOULD_LINEMERGE = false
TRUNCATE = 0
Questions:
1. Is it compulsory to use LINE_BREAKER and MAX_TIMESTAMP_LOOKAHEAD at here, if INDEXED_EXTRACTION is defined as json ?
2. If I do not wish to put INDEXED_EXTRACTIONS = json, what I have to put at LINE_BREAKER and MAX_TIMESTAMP_LOOKAHEAD ?
Highly appreciate if anyone guide on this.
↧