im trying to play around with tags from our aws environments (using the aws addon metadata input)
the tags come in looking like this:
"TagList": [
{"Key": "Project", "Value": "project1"}
{"Key": "ProdState", "Value": "prod"}
{"Key": "Product", "Value": "product1"}
{"Key": "Team", "Value": "team1"}
{"Key": "power_state", "Value": "-1:1800:1900:-1:1800:1900:-1:1800:1900:-1:1800:1900:-1:1800:1900:-1:-1:-1:-1:-1:-1:Australia/Brisbane"}
{"Key": "CostCentre", "Value": "000000"}
{"Key": "workload_type", "Value": "production"}
{"Key": "Name", "Value": "name1"}
]
to make life easier for myself, i am trying to un-nest these tags - ultimately i want this to look something like this:
tags.Project = project1tags.ProdState = prodtags.Product = product1...
ive tried with a foreach like this (below), but it doesnt seem to get all my tags out - for example, it will only extract CostCenter, ProdState Project and workload_type.
index=testing source="xxxxxxxxxxxx:ap-southeast-2:rds_instances"
| spath TagList{} output=tmp_taglist
| foreach tmp_taglist{}
[ rex "..Key.:\s\"(?<this_key>[^\"]+)\".\s.Value..\s\"(?<this_value>[^\"]+)\"."
| eval tags.{this_key} = this_value ]
| table DBInstanceArn tmp_taglist tags.*
can anyone help me understand what i am doing wrong here ?