How do you parse multiline key value events?

[vishaltaneja070]

How do you parse the below events?

The events looks like :

2018-12-04 01:51:08.330, LogDate="2018-12-04 01:51:08.33", SessionId="abc", MachineName="xyz", LoggerName="def", LogLevel="DEBUG", MessageId="DumpCacheNames", Message="def", ApplicationId="fgd", EndpointStack="abc", LogInsertDate="date"

I need to show events as:

 "2018-12-04 01:51:08.330"
 SessionId=abc 
 MachineName=xyz 
 LoggerName=def
 LogLevel=DEBUG
 MessageId=DumpCacheNames
 Message=def
 ApplicationId=fgd
 EndpointStack=abc
 LogInsertDate=date

Thanks !

[FrankVl · Accepted solution]

You want to change the appearance of the raw events, or you want to extract the fields? Based on your example, I'm assuming the first.

Not entirely sure why you'd want to format the raw events, but something like this should work:

in props.conf

[yoursourcetype]
SEDCMD-0split_to_lines = s/,\s/\n/g
SEDCMD-1strip_quotes = s/"//g
SEDCMD-2add_quotes = s/^([^\r\n]+)/"\1"/

Example in the searchbar:

| makeresults 
| eval _raw = "2018-12-04 01:51:08.330, LogDate=\"2018-12-04 01:51:08.33\", SessionId=\"abc\", MachineName=\"xyz\", LoggerName=\"def\", LogLevel=\"DEBUG\", MessageId=\"DumpCacheNames\", Message=\"def\", ApplicationId=\"fgd\", EndpointStack=\"abc\", LogInsertDate=\"date\""
| rex mode=sed "s/, /\n/g"
| rex mode=sed "s/\"//g"
| rex mode=sed "s/^([^\r\n]+)/\"\1\"/"

[vishaltaneja070]

@FrankVl
Great Buddy. It worked. Thanks 🙂

I want to change the appearance, it is already available in DB connect v1.

[493669]

Try

...|kv

or in props.conf-

KV_MODE = auto

[vishaltaneja070]

Nup didn't work. Any other suggestion?

[493669]

i tried with sample data and it is working as expected

| makeresults |eval _raw="\"2018-12-04 01:51:08.330\"
  SessionId=abc 
  MachineName=xyz 
  LoggerName=def
  LogLevel=DEBUG
  MessageId=DumpCacheNames
  Message=def
  ApplicationId=fgd
  EndpointStack=abc
  LogInsertDate=date"| kv

[vishaltaneja070]

Try with this string

2018-12-04 01:51:08.330, LogDate="2018-12-04 01:51:08.33", SessionId="abc", MachineName="xyz", LoggerName="def", LogLevel="DEBUG", MessageId="DumpCacheNames", Message="def", ApplicationId="fgd", EndpointStack="abc", LogInsertDate="date"