I followd the section to add a custom parser for awsS3 and created a file in \current\user\agent\fcp\awss3\awss3_parser_configuration.properties with below content: (more or less)
parser.type.count=8 parser.type[0].devicetype=MyType parser.type[0].description=MyType - Logs parser.type[0].filetype= parser.type[0].parserfolder=awss3 parser.type[0].parserfile=myTypeFile parser.type[0].parserclasstype=7
I also created a file myTypeFile.jsonparser.properties in the same folder.
that works perfectly.
However - I have to use more than one jsonparser, as the data i get is like audit, alarm and error logs. which share a common json section, but each type has its own special json objects.
therefor i would like to use
"__subParse" as described in the FlexDevGuide.
I added this to my json parser,
token[1].location=event/facility token[1].name=facility token[1].type=String token[1].format=__subParse(myType.subparsers.map.csv)
and created in \current\user\agent\fcp\awss3\ a file myType.subparsers.map.csv
however i get only an error from __subParse, not able to find the file:
[ERROR][com.arcsight.agent.sdk.d.b.d] [getMap]java.io.FileNotFoundException: config/agent/myType.subparsers.map.csv (No such file or directory)
Any suggestions?
SCFW is 8.4.4
Thanks A