and you don't have a line return in the string that is going to be transformed, the _scshort flag will return a nil a value. Therefore, the macro mecanism will say that the used macro is not a valid one and you will end up with the macro name in your event instead of the value.
when you use a macro such as
{output_schort] or {cache.service.output_scshort}
and you don't have a line return in the string that is going to be transformed, the _scshort flag will return a nil a value. Therefore, the macro mecanism will say that the used macro is not a valid one and you will end up with the macro name in your event instead of the value.
how to test it:
create a format file such as
use a stream connector that is compatible with the custom format feature.
send an event with a long output (for example, storage mode of linux plugin with the verbose option,
without the patch
this must also be tested with plugin that returns a very simple output, such as the ping one
without the patch
with the patch