Update p_zz_fallback.conf.tmpl

CSVD · Dec 20, 2019 · bbc83e8 · bbc83e8
1 parent 3a63295
commit bbc83e8
Showing 1 changed file with 1 addition and 6 deletions.
diff --git a/package/etc/conf.d/log_paths/p_zz_fallback.conf.tmpl b/package/etc/conf.d/log_paths/p_zz_fallback.conf.tmpl
@@ -6,6 +6,7 @@ log {
         rewrite {
             r_set_splunk_dest_default(sourcetype("sc4s:fallback"), index("main"));
             set("$(template ${.splunk.sc4s_template} $(template t_JSON))" value("MSG"));
+            unset(value("RAWMSG"));
         };
         parser {
             p_add_context_splunk(key("sc4s_fallback"));
@@ -15,12 +16,6 @@ log {
     {{- end}}
 
 
-        #in fallback archive only write rawmsg as msg
-        rewrite {
-            unset(value("RAWMSG"));
-            groupunset(values(".kv.*"));
-        };
-
     {{- if (getenv "SC4S_ARCHIVE_GLOBAL") or (getenv "SC4S_ARCHIVE_FALLBACK") }}
         destination(d_archive);
     {{- end}}