Seems the morphline is transforming the event into one without "body", are you converting the event body into headers? parseAsFlumeEvent only handles the body, the headers are lost.
On 2 June 2016 at 16:59, George M. <qazw3...@gmail.com> wrote: > With the morphlines and without multiplexing > ============================ > ------------------------------------------ > parseAsFlumeEvent = true > ------------------------------------------ > unixtime1420119195000address,example@example.cosiz1060 > <eruiz@kubiwireless.cosiz1060> > > hostip10.1.0.170line_type senderid938223BD77Cevent_route > SENDERmessage�2015 Jan 1 14:33:15 10.1.0.170 postfix-dsp/qmgr[5605]: > 938223BD77C: from=<exam...@example.com>, size=1060, nrcpt=1 (queue active) > > ------------------------------------------- > parseAsFlumeEvent = false > ------------------------------------------- > Only new lines >
