Hi, I am unable to figure out a regex that matches the key value pairs of my data , I think the transforms.conf regex and format would help here. I am posting a sample event.
It is just a FIELD_NAME:FIELD_VALUE pair. Just the first word of the event does not have a value associated with it.
I have tried this ([^\:]+)\:([^\,]+)\, but this not 100% accurate . Looking for more accuracy.
Do you mean that there is
Field name + possible value separated by : and those pairs is always separated by , ?