Need help with a Custom Parser config
The goal is split multiple JSON events sent in a batch into separate events. Going through the docs available to me, I've gotten to this -
<patternDefinitions> <pattern name="patSplitEventsFromAkamai"><![CDATA[\{.*]]></pattern> </patternDefinitions> <eventFormatRecognizer><![CDATA[\[PH_DEV_MON_CUSTOM_JSON\]:\[reptVendor\]=Akamai,\[reptModel\]=Cloud%20Control,]]></eventFormatRecognizer> <parsingInstructions> <switch> <case> <!-- Individual event format, process like normal --> <collectFieldsByRegex src="$_rawmsg"> <regex><![CDATA[\[PH_DEV_MON_CUSTOM_JSON\]:\[reptVendor\]=Akamai,\[reptModel\]=Cloud%20Control,\[json\]=<_json:patSplitEventsFromAkamai>]]></regex> </collectFieldsByRegex> <when test="exist _json"> <collectAndSetAttrByJSON src="$json"> <attrKeyMap attr="format" key="format"/> <attrKeyMap attr="version" key="version"/> <attrKeyMap attr="eventTime" key="start"/> <attrKeyMap attr="_logId" key="id"/> </collectAndSetAttrByJSON> </when> <when test="exist _logId"> <setEventAttribute attr="eventType">Akamai-Split</setEventAttribute> </when> </case> <case> <!-- monolithic event format, split into individual events --> <collectFieldsByRegex src="$_rawmsg"> <regex><![CDATA[\[PH_DEV_MON_CUSTOM_JSON\]:\[reptVendor\]=Akamai,\[reptModel\]=Cloud%20Control,]]></regex> </collectFieldsByRegex> <collectFieldsByKeyValuePair kvsep=":" sep="," src="$_rawmsg"> <attrKeyMap attr="reptDevName" key="reptDevName"/> <attrKeyMap attr="json" key="_json"/> </collectFieldsByKeyValuePair> <!-- input json, path, header, trailer, isDropBool --> <setEventAttribute attr="_resultCount">splitJsonEvent($_json, "type", "[PH_DEV_MON_CUSTOM_JSON]:[reptVendor]=Akamai,[reptModel]=Cloud%20Control,Akamai_Individual_Event,json=", "", "true")</setEventAttribute> </case> </switch> </parsingInstructions>
I get past validation (its valid XML) but run into this when testing
