topic How to create a new key-value pair name and value based on text within a log? in Getting Data In

How to create a new key-value pair name and value based on text within a log?

jizzmaster — Mon, 09 Feb 2015 20:38:49 GMT

I would like to create a whole new KV Pair, and based on the text from within a log, give it a specific value.

Example log 1:
user logged on

Example log 2:
user failed logon

Desired KV Pair:
Logon = yes
Logon = no

Is this possible? I suspect this would be done in props.conf, but not sure how to get started.

Re: How to create a new key-value pair name and value based on text within a log?

jrodman — Tue, 10 Feb 2015 14:27:58 GMT

You could construct such a field as part of a search string, or if you wanted it to always be available you could use a calculated field (EVAL-whatever). It's possible you could even express this as a "field extraction" where the value string is hardcoded.

Re: How to create a new key-value pair name and value based on text within a log?

tpflicke — Tue, 10 Feb 2015 15:36:55 GMT

The following eval clause might do the trick though it will result in field Logon being present with a blank value if neither phrase is found:

eval Logon=case(match(_raw,"user logged on"), "yes", match(_raw,"user failed logon"),"no",1==1,"")

As jrodman wrote this could be used as part of the search and should also work for creating a calculated field.

Another approach would be using rex mode=sed to change the text:

rex mode=sed field=_raw "s/user logged on/Logon=yes/" | rex mode=sed field=_raw "s/user failed logon/Logon=no/"

You might need a kv or

| rex field=_raw "Logon=(?<Logon>yes|no)"

to pick up the name value pair.

Re: How to create a new key-value pair name and value based on text within a log?

jizzmaster — Tue, 10 Feb 2015 19:31:01 GMT

That "eval" statement is pretty much exactly what I needed. Along with jrodman's answer, I was able to get this turned into an automatic field extraction by adding it in the props.conf. Thank you both.