I'm trying to extract value from a field in the raw text using a regular expression. I want the field values to be extracted in numeric format, but when I field extraction the value is in a string.
{"values":[17.4991095961511,17.4991095961511],"dstypes":["derive","derive"],"dsnames":["io_time","weighted_io_time"],"time":1565729243.743,"interval":2,"host":"node1-zanzibar","plugin":"disk","plugin_instance":"sda","type":"disk_io_time","type_instance":""}
I used the below expression,
^\{"(?P<values>\w+)
which captures the values field but not the values relative to that field.
So I tried with adding d+
^\{"(?P<values>\d+)
There was no result. can anyone help me solve this?
Can you try this?
|makeresults
|eval _raw=" {\"values\":[17.4991095961511,17.4991095961511],\"dstypes\":[\"derive\",\"derive\"],\"dsnames\":[\"io_time\",\"weighted_io_time\"],\"time\":1565729243.743,\"interval\":2,\"host\":\"node1-zanzibar\",\"plugin\":\"disk\",\"plugin_instance\":\"sda\",\"type\":\"disk_io_time\",\"type_instance\":\"\"} "
| rex field=_raw "\{\"values\"\:\[(?<values>.*?)\s*\]\," max_match=0
| makemv delim="," values
| mvexpand values
| table values
Can you try this?
|makeresults
|eval _raw=" {\"values\":[17.4991095961511,17.4991095961511],\"dstypes\":[\"derive\",\"derive\"],\"dsnames\":[\"io_time\",\"weighted_io_time\"],\"time\":1565729243.743,\"interval\":2,\"host\":\"node1-zanzibar\",\"plugin\":\"disk\",\"plugin_instance\":\"sda\",\"type\":\"disk_io_time\",\"type_instance\":\"\"} "
| rex field=_raw "\{\"values\"\:\[(?<values>.*?)\s*\]\," max_match=0
| makemv delim="," values
| mvexpand values
| table values