Hi Chris,
It's hard to guess what you are *ing up without the config but it appears
that the enclosing [] might be an issue.
If the JSON payload is all you need then the following could work with
om_tcp:
Exec if $raw_event =~ /\[({.+})\]$/ $raw_event = $1;
Regards,
Botond
On Mon, 4 Aug 2014 13:
Because I'm confused. :-)
Ok, so I got rid of the multiline. Still having issues.
What would be the proper im_out module for NX and input for logstash?
Originally I thought I could do TCP out from NXLog (no conversion) and
"PLAIN" input for Loggstash with "JSON" format. Still fails to parse..
W
On Sun, 3 Aug 2014 12:52:21 -0400
Didjit Charlebois wrote:
> Module xm_multiline
> #2014-07-31T18:59:57-0400
> HeaderLine /^\d\d\d\d.\d\d.\d\dT\d\d:\d\d:\d\d-0400/
> ...
> 2014-08-03T12:23:14-0400[{"open":"2014-08-03T13:00:00.000+","close":"2014-08-04T01:00:00.000+","isOpen":true,
