Hello, I have the following type of event, and I would like to extract the `tags` field into its respective fields.
2022-10-17 06:50:00.997, root_device_name="/dev/sda1", root_device_type="ebs", state_name="running", subnet_id="subnet-REDACTED", tags="{"App": "myapp", "Name": "myserver", "Owner": "myteam", "Scope": "myscope", "AWSBackup": "True", "Environment": "myenv", "Compliance requirement": "N/A"}", virtualization_type="hvm", vpc_id="vpc-REDACTED"
I have tried the following which did not work for me:
index=myindex sourcetype=mysourcetype earliest=@d i-REDACTED source=awsec2instances
| spath input=tags
How do I extract these JSON fields from an event like this?
Try something like this
| rex "tags=\"(?<tags>\{[^\}]+\})"
| spath input=tags