Json field extraction rule not allowed?
Hi all,
My log body contains just valid json serialized string. I attempted to follow this instruction to set up json parser expression:
https://service.sumologic.com/help/Default.htm#JSON_Operator.htm?Highlight=JSON
like this:
parse "*" as jsonobject | json field=jsonobject "transactionId"
but the rule validator keeps rejecting my parse expression.
Can sumo experts here help me understand what I have done wrong? Thanks.
-
Official comment
Support for using the JSON and KV operators is upcoming in field extraction rule. Presently, it is not support and this is the reason the rule validator blocks that. We will keep you posted on our progress.
Comment actions -
Update: August 1, 2016
Field Extraction Rules now Support JSON and CSV. Field Extraction Rules (FERs) now support the JSON and CSV operators. (JSON auto and CSV auto) are not supported. For details, see Create a Field Extraction Rule.
Please sign in to leave a comment.
Comments
3 comments