How to create a new key-value pair name and value based on text within a log?

[jizzmaster]

I would like to create a whole new KV Pair, and based on the text from within a log, give it a specific value.

Example log 1:
user logged on

Example log 2:
user failed logon

Desired KV Pair:
Logon = yes
Logon = no

Is this possible? I suspect this would be done in props.conf, but not sure how to get started.

[tpflicke · Accepted solution]

The following eval clause might do the trick though it will result in field Logon being present with a blank value if neither phrase is found:

eval Logon=case(match(_raw,"user logged on"), "yes", match(_raw,"user failed logon"),"no",1==1,"")

As jrodman wrote this could be used as part of the search and should also work for creating a calculated field.

Another approach would be using rex mode=sed to change the text:

rex mode=sed field=_raw "s/user logged on/Logon=yes/" | rex mode=sed field=_raw "s/user failed logon/Logon=no/" 

You might need a kv or

| rex field=_raw "Logon=(?<Logon>yes|no)"

to pick up the name value pair.

[jizzmaster]

That "eval" statement is pretty much exactly what I needed. Along with jrodman's answer, I was able to get this turned into an automatic field extraction by adding it in the props.conf. Thank you both.

[jrodman]

You could construct such a field as part of a search string, or if you wanted it to always be available you could use a calculated field (EVAL-whatever). It's possible you could even express this as a "field extraction" where the value string is hardcoded.