modification de champ

deployment-apps/Splunk_TA_linky/local/props.conf

@@ -1,4 +1,6 @@
-[json]
+[_json]
 KV_MODE = json
 TRANSFORMS-extract_json = extract_json_fields
+TRANSFORMS-rename_date = rename_field_date
+TRANSFORMS-rename_value = rename_field_value
 TRUNCATE = 0

deployment-apps/Splunk_TA_linky/local/transforms.conf

@@ -1,4 +1,10 @@
 [extract_json_fields]
 REGEX = \"(?<field_name>[^\"]+)\":\s?\"(?<field_value>[^\"]+)\"
 FORMAT = $1::$2
-WRITE_META = true
+WRITE_META = true
+
+[rename_field_date]
+REGEX = interval_reading\{\}\.date=(?P<interval_reading\.date>[^\s]+)
+
+[rename_field_value]
+REGEX = interval_reading\{\}\.value=(?P<interval_reading\.value>[^\s]+)