Hi everybody,
I am extracting nested JSON with KV_MODE = JSON, which seems to work correctly.
My problem is, I am getting field names with hyphens in it (like in the raw event) e.g. "alert.expl.cnc-services.cnc-service.sid". First of all, is there any possibility of key cleaning while using KV_MODE = JSON extraction? For example I am not able to use the extracted field above in coalesce function because of the hyphen. Can anybody help me?
You cannot prevent it without doing your own manual field extraction but what you can do is remove/replace them at the beginning of your search by doing something like this (which would best be done inside a macro called dash2underscore
)
.... | rename *-*-*-*-*-* AS *_*_*_*_*_*, *-*-*-*-* AS *_*_*_*_*, *-*-*-* AS *_*_*_*, *-*-* AS *_*_*, *-* AS *_*
You can use a combination of props.conf and transforms.conf to replace the dash "-" with the symbol of your choice.
Within transforms.conf, set DEST_KEY = _raw.
Note that this method requires a HF and would take effect on newly indexed data only (it would not be retroactive).