`{
"name": "Joe",
"variables":[
{
"variableName":"age",
"variableValue":"30"
},
{
"variableName":"gender",
"variableValue":"male"
},
{
"variableName":"state",
"variableValue":"WA"
}]
How do I go about selecting for example the gender or age in this log?
You can do this:
YOUR_SEARCH | rex "\"variableName\"\s*:\s*\"age\"\s*,\s*\"[^\"]+\"\s*:\s*\"(?<age>[^"]*)\""
to get the age. Or you can use this sort of field extraction to extract all values properly:
props.conf
[my_sourcetype]
REPORT-my_json_pairs = my_json_pairs
transforms.conf
[my_json_pairs]
REGEX = \"variableName\"\s*:\s*\"(?<_KEY_1>[^"]*)\"\s*,\s*\"[^\"]+\"\s*:\s*\"(?<_VAL_1>[^"]*)\"
All the best