How to create regex for Array of objects while creating indexed-fields

[nagendraDumpala]

We have an object like below.

{ "mirId": "Mule-111", "appVersion": "v1", "businessGroup": "MARKETING", "compress": false, "appName": "dev-sys-netsuite-int-v1", "relational_correlationId": "c96563d1-acb3-11ea-9d9b-0654f1d3f281", "tracePointDescription": "Capture payload", "threadName": "[MuleRuntime].cpuLight.13: [adaptive-logger-test].adaptive-loggerFlow.CPU_LITE @6dbce5f9", "content": { "exception": "", "payload": "https://s3.console.aws.amazon.com/s3/object/unilever-ai-operationalframework/LEVEREDGE/prod/dispatch...", "businessFields": [ { "key": "File_Name", "value": "ASN_200622170087026.xml" }, { "key": "IDOC_NAME", "value": "0000001408187026" } ], "category": "org.unilever.apps.adaptiveloggertest" }, "environment": "TJ-MARKETING-Dev", "LogMessage": "Test-TJ-SCHED", "correlationId": "c98f8110-acb3-11ea-9d9b-0654f1d3f281", "interfaceName": "netsuite-salesapi", "tracePoint": "START", "timestamp": "2020-12-06T13:59:21.133Z" }

Now we need to create a regex for matching the key & value from businessFields array. And the values of "key" , "value" should be stored as multi-value fields. we need to use this regex in transforms.conf for creating indexed-fields.

[Birbal · Accepted solution]

Have you already tried applying INDEXED_EXTRACTIONS=JSON in your props.conf at your universal forwarder level (or wherever the input is configured)?

[nagendraDumpala]

Hi Birbal,

Thank you so much for your support.  Your suggestion make my job very cool.