It seems the extract/kv command uses _raw as input to do its parsing. Is there any way to pass a previously extracted field to it instead?
Given this sample event:
| stats count
| eval _raw="messageToParse=\"key1:val1,key2:val2,key3:val3\" user=\"user123\" application=\"app123\" host=\"host123\""
I'm looking for something similar to:
| extract kvdelim=":" pairdelim="," input=messageToParse
to produce a table of:
key1 | key2 | key3
val1 | val2 | val3
Note: The number of kvps in messageToParse is greater than 50, so parsing them individually via regex is not suitable.
Any ideas?
One workaround is this
| gentimes start=-1 | eval _raw="messageToParse=\"key1:val1,key2:val2,key3:val3\" user=\"user123\" application=\"app123\" host=\"host123\"" | table _raw | extract | rename _raw as temp messageToParse as _raw | extract kvdelim=":=" pairdelim=", " | rename _raw as messageToParse | rename temp as _raw
One workaround is this
| gentimes start=-1 | eval _raw="messageToParse=\"key1:val1,key2:val2,key3:val3\" user=\"user123\" application=\"app123\" host=\"host123\"" | table _raw | extract | rename _raw as temp messageToParse as _raw | extract kvdelim=":=" pairdelim=", " | rename _raw as messageToParse | rename temp as _raw
Thanks for the reply - I saw something similar in another post as well I think. The trouble I had was finding a way to limit the results in the table/output to only the keys parsed from messageToParse, instead of including user,application, etc, without manually specifying each key to display.
If in your final results, you only want to show keys which are included in messageToParse, they try like this
| gentimes start=-1 | eval _raw="messageToParse=\"key1:val1,key2:val2,key3:val3\" user=\"user123\" application=\"app123\" host=\"host123\"" | table _raw | extract | table messageToParse| rename messageToParse as _raw | extract kvdelim=":=" pairdelim=", " | fields - _raw