How do you extract fields from JSON logs?

[moizmmz]

Hello,

I have the following JSON log event:

{   [-] 
     line:   I 1019 15:40:22.873 UTC THREAD1: **linkerd 1.4.5** (rev=0280009ca71e0673108a3752763938017bda588f) built at 20180713-154546 
     source:     stderr 
     tag:    linkerd/e03c11099322   
}

I want to extract the version of Linkerd given in this log. i.e., I want the following result: Field name: Linkerd version; value: 1.4.5

Pls help!!

[493669 · Accepted solution]

try this regex to extract linkerd version-

   ... |rex "linkerd\s(?<linkerd_version>[^\s]+)" 

[moizmmz]

Excellent! It gives me exactly what i want! Thank you so so much!!

Can you please tell me how you wrote this?

[493669]

Here rex command is used to extract field values
Explanation:
linkerd\s here \s indicates space so it will find word-linkerd in raw events
[^\s]+ It will check after linkerd\s until it will find any space
(?<linkerd_version> then it will store extracted value in field name linkerd_version

[moizmmz]

Thank you thank you thank you!!!!!!