0

My json custom formatted events are from a log file which contains parameters names with dots like id.orig_h etc. Sample event is:

{"ts":"2016-05-08 08:59:47.363764Z","uid":"CLuCgz3HHzG7LpLwH9","id.orig_h":"172.30.26.119","id.orig_p":51976,"id.resp_h":"172.30.26.160","id.resp_p":22,"version":2,"client":"SSH-2.0-OpenSSH_5.0","server":"SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.6","cipher_alg":"arcfour256","mac_alg":"hmac-md5","compression_alg":"none","kex_alg":"diffie-hellman-group-exchange-sha1","host_key_alg":"ssh-rsa","host_key":"8d:df:71:ac:29:1f:67:6f:f3:dd:c3:e5:2e:5f:3e:b4"}

But event receiver does not take such events and gives mapping errors saying:

Could not find any matches for the incoming event with JSONPath : com.jayway.jsonpath.JsonPath@543abe49 ,hence dropping the event

If I cant change my log file, How can I make receiver to accept such parameters? Also unless my events are not segregated with *****, receiver does not bother any further coming events. Why is so? How can I avoid it?

Community
  • 1
  • 1
aneela
  • 1,457
  • 3
  • 24
  • 45

1 Answers1

0

I simply have modified my log files before sending it via any client. I was using sample 0002, So I changed my message to comply with the receiver. However I still dont know why receiver does not accept parameters with dots in it. This sample also considered events to be separated by asterixLine i.e. *****. On removing a couple of sample lines, I made it work.

aneela
  • 1,457
  • 3
  • 24
  • 45