I have this:
{"date": null, "facility": -1, "host": null, "level": -1, "message": "2017-11-13T03:45:00+0000 monStatsLog, applianceName=xxxxx, tenantName=xxxx, mstatsTimeBlock=1510544700, tenantId=1, vsnId=0, mstatsTotSentOctets=250, mstatsTotRecvdOctets=0, mstatsTotSessDuration=26001, mstatsTotSessCount=1, mstatsType=sdwan-acc-ckt-app-stats, mstatsId=tftp:Controller1:MPLS:1:2, mstatsAttribs=1:3:general-internet:file-server:Unknown", "charset": "UTF-8", "remote_address": "xxxxxxx", "hostname": "xxxxxx"}
I'm trying to parse a json file with entries like above, where the message
field has multiple values, which are in turn delimited using comma and =. How can I parse that specific field to extract all the information?
Assuming that your JSON is coherent and being processed correctly you should already have a message
field so just do this:
| makeresults
| eval message="2017-11-13T03:45:00+0000 monStatsLog, applianceName=xxxxx, tenantName=xxxx, mstatsTimeBlock=1510544700, tenantId=1, vsnId=0, mstatsTotSentOctets=250, mstatsTotRecvdOctets=0, mstatsTotSessDuration=26001, mstatsTotSessCount=1, mstatsType=sdwan-acc-ckt-app-stats, mstatsId=tftp:Controller1:MPLS:1:2, mstatsAttribs=1:3:general-internet:file-server:Unknown"
| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"
| rename message AS _raw
| kv
It helped. Thanks!