topic Re: How do you parse multiline key value events? in Getting Data In

How do you parse multiline key value events?

vishaltaneja070 — Tue, 04 Dec 2018 07:47:21 GMT

How do you parse the below events?

The events looks like :

2018-12-04 01:51:08.330, LogDate="2018-12-04 01:51:08.33", SessionId="abc", MachineName="xyz", LoggerName="def", LogLevel="DEBUG", MessageId="DumpCacheNames", Message="def", ApplicationId="fgd", EndpointStack="abc", LogInsertDate="date"

I need to show events as:

 "2018-12-04 01:51:08.330"
 SessionId=abc 
 MachineName=xyz 
 LoggerName=def
 LogLevel=DEBUG
 MessageId=DumpCacheNames
 Message=def
 ApplicationId=fgd
 EndpointStack=abc
 LogInsertDate=date

Thanks !

Re: How do you parse multiline key value events?

493669 — Tue, 04 Dec 2018 07:55:49 GMT

Try

...|kv

or in props.conf-

KV_MODE = auto

Re: How do you parse multiline key value events?

vishaltaneja070 — Tue, 04 Dec 2018 08:02:15 GMT

Nup didn't work. Any other suggestion?

Re: How do you parse multiline key value events?

493669 — Tue, 04 Dec 2018 08:15:24 GMT

i tried with sample data and it is working as expected

| makeresults |eval _raw="\"2018-12-04 01:51:08.330\"
  SessionId=abc 
  MachineName=xyz 
  LoggerName=def
  LogLevel=DEBUG
  MessageId=DumpCacheNames
  Message=def
  ApplicationId=fgd
  EndpointStack=abc
  LogInsertDate=date"| kv

Re: How do you parse multiline key value events?

FrankVl — Tue, 04 Dec 2018 08:21:13 GMT

You want to change the appearance of the raw events, or you want to extract the fields? Based on your example, I'm assuming the first.

Not entirely sure why you'd want to format the raw events, but something like this should work:

in props.conf

[yoursourcetype]
SEDCMD-0split_to_lines = s/,\s/\n/g
SEDCMD-1strip_quotes = s/"//g
SEDCMD-2add_quotes = s/^([^\r\n]+)/"\1"/

Example in the searchbar:

| makeresults 
| eval _raw = "2018-12-04 01:51:08.330, LogDate=\"2018-12-04 01:51:08.33\", SessionId=\"abc\", MachineName=\"xyz\", LoggerName=\"def\", LogLevel=\"DEBUG\", MessageId=\"DumpCacheNames\", Message=\"def\", ApplicationId=\"fgd\", EndpointStack=\"abc\", LogInsertDate=\"date\""
| rex mode=sed "s/, /\n/g"
| rex mode=sed "s/\"//g"
| rex mode=sed "s/^([^\r\n]+)/\"\1\"/"

Re: How do you parse multiline key value events?

vishaltaneja070 — Tue, 04 Dec 2018 09:51:32 GMT

Try with this string

2018-12-04 01:51:08.330, LogDate="2018-12-04 01:51:08.33", SessionId="abc", MachineName="xyz", LoggerName="def", LogLevel="DEBUG", MessageId="DumpCacheNames", Message="def", ApplicationId="fgd", EndpointStack="abc", LogInsertDate="date"

Re: How do you parse multiline key value events?

vishaltaneja070 — Tue, 04 Dec 2018 10:09:01 GMT

@FrankVl
Great Buddy. It worked. Thanks 🙂

I want to change the appearance, it is already available in DB connect v1.