topic Re: How do you extract fields from JSON logs? in Getting Data In

How do you extract fields from JSON logs?

moizmmz — Fri, 19 Oct 2018 17:00:27 GMT

Hello,

I have the following JSON log event:

{   [-] 
     line:   I 1019 15:40:22.873 UTC THREAD1: **linkerd 1.4.5** (rev=0280009ca71e0673108a3752763938017bda588f) built at 20180713-154546 
     source:     stderr 
     tag:    linkerd/e03c11099322   
}

I want to extract the version of Linkerd given in this log. i.e., I want the following result: Field name: Linkerd version; value: 1.4.5

Pls help!!

Re: How do you extract fields from JSON logs?

493669 — Fri, 19 Oct 2018 17:35:51 GMT

try this regex to extract linkerd version-

   ... |rex "linkerd\s(?<linkerd_version>[^\s]+)"

Re: How do you extract fields from JSON logs?

moizmmz — Fri, 19 Oct 2018 17:39:41 GMT

Excellent! It gives me exactly what i want! Thank you so so much!!

Can you please tell me how you wrote this?

Re: How do you extract fields from JSON logs?

493669 — Fri, 19 Oct 2018 18:24:56 GMT

Here rex command is used to extract field values
Explanation:
linkerd\s here \s indicates space so it will find word-linkerd in raw events
[^\s]+ It will check after linkerd\s until it will find any space
(?<linkerd_version> then it will store extracted value in field name linkerd_version

Re: How do you extract fields from JSON logs?

moizmmz — Fri, 19 Oct 2018 19:03:42 GMT

Thank you thank you thank you!!!!!!