Ryan Faircloth
Ryan Faircloth
Sorry @gaborznagy I was not clear enough I do have the drop-invalid(yes) option set but the invalid sdata does not cause a drop. Missing "1" or invalid date fields do...
The full syntax in sc4s is could you try this syntax if it matters the initial source is ``` flags(validate-utf8, no-parse , store-raw-message) ``` Then the inline parser is ```...
Reference code to encode with gzip and post http://mattikariluoma.com/blog/cURL%20+%20gzip%20(Beating%20a%20Dead%20Horse).html
Taken from a pcap and anonymized. we would have to set host to ip for every message then set it back to the real host. ```text 2022-02-11T11:41:05.395Z esxhos Vpxa: info...
These are actually "over network" and "udp" at that
It might but I may have found a solution with the kv store poc being able to restore HOST from cache would also solve this
I still think this could be useful but my work around to cache host name worked
I have also run into this
Sorry lots of github messages I didn't see the ask for respose Right now real epoch is 1610996436 %s works fine epoch with ms 1610996436.3456 works fine with %s.%f some...
for Rhel 8/ubi 8 its in app streams now https://centos.pkgs.org/8/centos-appstream-aarch64/python39-3.9.2-1.module_el8.4.0+720+bfbc1bcb.aarch64.rpm.html