I have some log entries that look like the following:
foo2011-06-25T20:12:54 [a.b.c.d] Promoting SystemFingerprint [[architecture=null][certainty=0.8][description=Sun Solaris][deviceClass=null][family=Solaris][product=Solaris][vendor=Sun][version=null]] source: NTP
In some (all?) cases, when the default extractions happen, fields that have whitespace don't appear to be extracting correctly. For example, I would like 'description' from the above example to be 'Sun Solaris', however it is 'Sun'. I have tried the following with extract:
extract pairdelim="\]\[", kvdelim="=" auto=f
One workaround I have used is to use rex to pull out all of the fields, however the format for these logs isn't always the same (there may be more key value pairs, sometimes in a different order).
Any ideas?
The following should work:
props.conf
[your_sourcetype]
REPORT-bean-kv = extract-bean-kv
KV_MODE = none
transforms.conf
[extract-bean-kv]
REGEX = \[([^=\]]+)=([^=\]]+)\]
FORMAT = $1::$2
CLEAN_KEYS = true
The following should work:
props.conf
[your_sourcetype]
REPORT-bean-kv = extract-bean-kv
KV_MODE = none
transforms.conf
[extract-bean-kv]
REGEX = \[([^=\]]+)=([^=\]]+)\]
FORMAT = $1::$2
CLEAN_KEYS = true
Perfect. Thank you.