Sending a JSON payload as a single message
We want to treat a JSON payload as a single message. For example:
{
"MONITOR_NAME": "customer.sql",
"SCHEDULED_FOR_STAMP": "2023-02-05 13:55:00 PST",
"RECORDS_IN_PAST_75_MINUTES": 9
}
We are sending via HTTP with Multiline Processing enabled.
We tried for message boundary both Detect Automatically and our own regex:
\n?\{
Detect Automatically gave us multiple rows in Sumo Logic (whereas we wanted just the one). Using our own regex caused the message to not post at all.
Thank you,
Jason
-
If you're sending only a single message within the payload of a request to the HTTPs source endpoint then what you'll want to do is enable the Advanced flag for "One Message Per Request" (disable the multi-line option) With this option enabled the request payload will be considered as a single message.
-
Thanks @kevin I'll give it a shot:
>>> message1
'Hello world'
>>> message2
'{"MONITOR_NAME": "customer.sql", "SCHEDULED_FOR_STAMP": "2023-02-05 13:55:00 PST", "RECORDS_IN_PAST_75_MINUTES": 9}'
>>> requests.post(url, message1)
<Response [200]>
>>> requests.post(url, message2)
<Response [200]> -
Given the 200 response code the second message should be there. I suspect that due to the timestamp in the message that you might need to search for this message using a time frame that covers that date/time. Otherwise if you try the "receipt time" search option the message may show up along with the other as this option ignores any parsed timestamps and just shows messages based on when Sumo received them.
Please sign in to leave a comment.
Comments
6 comments