I am trying to extract field and key/value parameters from a ruby on rails log file. What ways can I do this? My events have Parameters in the following format:
Processing blah blah blah
Parameters: {"item1"=>"food", "item2"=>"drink", "item3"=>"water"}
You can do this via configuration files or search-time "kv" (aka extract command). Specifically, for your situation you want to delimit based on the "=>" and ", ". You can use the extract command as follows:
... | extract pairdelim=", }{", kvdelim="=>", auto=f
This will turn off auto extraction, break the key value pairs based on the =>, and break the pairs based on the "," whitespace, or either curly bracket. So your extracted fields would be:
item1=food
item2=drink
item3=water