topic How to extract the specific key value pair ? in Dashboards & Visualizations

How to extract the specific key value pair ?

mlevsh — Wed, 05 May 2021 00:52:20 GMT

We have the following data ingested (not json format) , where we are trying to extract
"DeletedImages": 0 and "DeletedImages": 24 value pairs

Data:

2021-05-04 - 13:50:41.878 - INFO : Action completed in 0.192996025085 seconds, result is {
"images-deleted": 0,
"metrics": {
"Action": "Ec2DeleteImageAction",
"Data": {
"DeletedImages": 0
},
"Version": "1.0",
"Type": "action",
"ActionId": "12345"
},
"account": "123456789",
"task": "ABCD-EFGE-QAQ-DELETE-IMAGE",
"images": 535,
"region": "ab-east-1"
} - ReconNum:123456678901234

2021-05-04 - 13:55:41.878 - INFO : Action completed in 0.192996025085 seconds, result is {
"images-deleted": 0,
"metrics": {
"Action": "Ec2DeleteImageAction",
"Data": {
"DeletedImages": 24
},
"Version": "1.0",
"Type": "action",
"ActionId": "12345"
},
"account": "123456788",
"task": "ABCD-EFGE-QAQ-DELETE-IMAGE",
"images": 536,
"region": "ab-east-1"
} - ReconNum:123456678901235

Re: How to extract the specific key value pair ?

bowesmana — Wed, 05 May 2021 01:03:10 GMT

Use rex with

| rex field=_raw "DeletedImages.:\s(?<DeletedImageCount>\d+)"

Re: How to extract the specific key value pair ?

bowesmana — Wed, 05 May 2021 01:05:27 GMT

Assuming that is two events. If it is a single event and you need to extract both values from it, then modify the rex statement like this

| rex field=_raw max_match=0 "DeletedImages.:\s(?<DeletedImageCount>\d+)"

and you will get a multi value field with the two values

Re: How to extract the specific key value pair ?

mlevsh — Wed, 05 May 2021 19:51:31 GMT

@bowesmana Thank you! That worked perfectly!