How can I correctly break up giant JSON events?

Question

I have a rest pull that is one giant json event - doesn’t appear to have new-line entries. The events get broken up incorrectly, so I’m assuming that my event breaker needs work, but the only json event breaker that I see is for json with new-lines. How should I handle this?

Raanan Dagan · Answer

Try to create an event breaker that looks like this:
The name of the Array field, JSON Extract field, and Max Event Bytes needs to be modified
Once you have created this event breaker, on the REST API → Event Breaker → add your new event breaker

Sign up

Using your Cribl Curious or University Account

Login to the community

Using your Cribl Curious or University Account