How do you select a key value based on key name?

[jmount15]

I have a log that looks similar to this:

`{
"name": "Joe",
"variables":[
{
"variableName":"age",
"variableValue":"30"
},
{
"variableName":"gender",
"variableValue":"male"
},
{
"variableName":"state",
"variableValue":"WA"
}]

}`

How do I go about selecting for example the gender or age in this log?

[chrisyounger]

You can do this:

YOUR_SEARCH | rex "\"variableName\"\s*:\s*\"age\"\s*,\s*\"[^\"]+\"\s*:\s*\"(?<age>[^"]*)\""

to get the age. Or you can use this sort of field extraction to extract all values properly:

props.conf

[my_sourcetype]
REPORT-my_json_pairs = my_json_pairs

transforms.conf

[my_json_pairs]
REGEX = \"variableName\"\s*:\s*\"(?<_KEY_1>[^"]*)\"\s*,\s*\"[^\"]+\"\s*:\s*\"(?<_VAL_1>[^"]*)\"

All the best