How to extract a list of quoted key value pairs when some values have spaces?

prcough — Wed, 31 Jul 2019 18:55:28 GMT

Hello,

I am attempting to figure out how to extract the following example event for all fields (the real event has ~30 fields but these show all use cases).

{'start_time': '2019-07-30 15:19:20', 'duration': '2', 'ip': '192.168.1.1', 'mac': '00:00:00:00:00:00', 'source': 'open source'}

I started my attempts with delimiters I found through some googling,

transforms.conf
[my_sourcetype]
DELIMS = "\"{,}", ": "

With this in place the event would have duration and IP extracted, but not mac, source, or start_time.

Any help is appreciated.

Re: How to extract a list of quoted key value pairs when some values have spaces?

jnudell_2 — Wed, 30 Sep 2020 01:32:46 GMT

You're missing the command to allow multiple values:



transforms.conf

[my_sourcetype]

DELIMS = "\"{,}", ": "

MV_ADD = true

You could also try:



[my_sourcetype]

REGEX = '([^']+)': '([^']+)'

FORMAT = $1::$2

MV_ADD = true