field extractions transforms

nawazns5038 — Thu, 16 Jul 2020 18:32:44 GMT

Hi,

I am unable to figure out a regex that matches the key value pairs of my data , I think the transforms.conf regex and format would help here.

I am posting a sample event.

SAEGW-SGW10,sdfsd-sdfafsadf:1,sdafsdf:3,asdfsdf:3,dsfgdsfgretewq:0

It is just a FIELD_NAME:FIELD_VALUE pair. Just the first word of the event does not have a value associated with it.

I have tried this ([^\:]+)\:([^\,]+)\, but this not 100% accurate . Looking for more accuracy.

Thanks

Re: field extractions transforms

isoutamo — Thu, 16 Jul 2020 19:32:09 GMT

Do you mean that there is

Field name + possible value separated by : and those pairs is always separated by , ?

r. Ismo

topic field extractions transforms in Getting Data In

field extractions transforms

Re: field extractions transforms