-
Hi, I'm trying to convert the "classic mode" configuration to YAML and I have a problem with the fact that I need to convert this config to YAML:
I didn't find in the documentation how to do this. I tried to understand from the source code, but nothing works either. I tried to do this decode_field_as:
- type: escaped
field: message
action: try_next
- type: json
field: message and that decode_field_as:
- escaped message try_next
- json message
also, rules:
- backend: decode_field_as
type: escaped
field: message
action: try_next
- backend: decode_field_as
type: json
field: message but nothing works either, I get error
|
Beta Was this translation helpful? Give feedback.
Answered by
allewell
Dec 13, 2024
Replies: 1 comment 1 reply
-
I'm not sure, but have you tried duplicating it? : decode_field_as: escaped message try_next
decode_field_as: json message That works in some places (eg rewrite_tag filter:) - name: rewrite_tag
match: something
rule: '$log "java\.lang\.OutOfMemoryError" critical_events_temp_1 true'
rule: '$log "java\.lang\.StackOverflowError" critical_events_temp_2 true' But not let's say in tail input path, which is comma delimited: inputs:
- name: tail
path: >-
some_path/atlassian-jira.log*,
some_path/atlassian-jira-stats.log* |
Beta Was this translation helpful? Give feedback.
1 reply
Answer selected by
heejew
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I'm not sure, but have you tried duplicating it? :
That works in some places (eg rewrite_tag filter:)
But not let's say in tail input path, which is comma delimited: