How do you select a key value based on key name?

jmount15 — Wed, 27 Feb 2019 19:27:43 GMT

I have a log that looks similar to this:

`{
"name": "Joe",
"variables":[
{
"variableName":"age",
"variableValue":"30"
},
{
"variableName":"gender",
"variableValue":"male"
},
{
"variableName":"state",
"variableValue":"WA"
}]

}`

How do I go about selecting for example the gender or age in this log?

Re: How do you select a key value based on key name?

chrisyounger — Wed, 27 Feb 2019 20:51:34 GMT

You can do this:

YOUR_SEARCH | rex "\"variableName\"\s*:\s*\"age\"\s*,\s*\"[^\"]+\"\s*:\s*\"(?<age>[^"]*)\""

to get the age. Or you can use this sort of field extraction to extract all values properly:

props.conf

[my_sourcetype]
REPORT-my_json_pairs = my_json_pairs

transforms.conf

[my_json_pairs]
REGEX = \"variableName\"\s*:\s*\"(?<_KEY_1>[^"]*)\"\s*,\s*\"[^\"]+\"\s*:\s*\"(?<_VAL_1>[^"]*)\"

All the best

topic Re: How do you select a key value based on key name? in Getting Data In

How do you select a key value based on key name?

I have a log that looks similar to this:

}`

Re: How do you select a key value based on key name?