How do I extract Key Value pairs from Ruby on Rails logs?

Simeon — Tue, 09 Nov 2010 06:37:48 GMT

I am trying to extract field and key/value parameters from a ruby on rails log file. What ways can I do this? My events have Parameters in the following format:

Processing blah blah blah
  Parameters:  {"item1"=>"food", "item2"=>"drink", "item3"=>"water"}

Re: How do I extract Key Value pairs from Ruby on Rails logs?

Simeon — Tue, 09 Nov 2010 06:40:28 GMT

You can do this via configuration files or search-time "kv" (aka extract command). Specifically, for your situation you want to delimit based on the "=>" and ", ". You can use the extract command as follows:

... | extract pairdelim=", }{", kvdelim="=>", auto=f

This will turn off auto extraction, break the key value pairs based on the =>, and break the pairs based on the "," whitespace, or either curly bracket. So your extracted fields would be:

item1=food
item2=drink
item3=water

topic Re: How do I extract Key Value pairs from Ruby on Rails logs? in Splunk Search

How do I extract Key Value pairs from Ruby on Rails logs?

Re: How do I extract Key Value pairs from Ruby on Rails logs?