Seems the morphline is transforming the event into one without "body", are you converting the event body into headers? parseAsFlumeEvent only handles the body, the headers are lost.
On 2 June 2016 at 16:59, George M. <[email protected]> wrote: > With the morphlines and without multiplexing > ============================ > ------------------------------------------ > parseAsFlumeEvent = true > ------------------------------------------ > unixtime1420119195000address,[email protected] > <[email protected]> > > hostip10.1.0.170line_type senderid938223BD77Cevent_route > SENDERmessage�2015 Jan 1 14:33:15 10.1.0.170 postfix-dsp/qmgr[5605]: > 938223BD77C: from=<[email protected]>, size=1060, nrcpt=1 (queue active) > > ------------------------------------------- > parseAsFlumeEvent = false > ------------------------------------------- > Only new lines >
