How do I prevent the double underscore internal Cribl fields from being inserted into the _raw?
I'm trying to serialize into JSON and just keep the _raw field left over after bringing all the fields together. How do I prevent the double underscore internal Cribl fields from being inserted into the _raw field I'm creating?
Answers
-
https://docs.cribl.io/stream/introduction-reference#wildcard-lists|https://docs.cribl.io/stream/introduction-reference#wildcard-lists negate them with ! In the Fields to serialize field.
0 -
It didn't seem to work within the serializing function. I had to add an eval before the serialize and explicitly remove all double underscore fields that way
0 -
Kind of annoying
0 -
Since I'm not seeing them until I forward them to Splunk. They don't show up in my previews of my log samples
0 -
in the fields to serialize field: `!* !cribl* *`
0 -
I see now. I had the wildcard first but you need to put all excludes first.
0 -
yep! let me know how it goes
0
