We want to extract Json key&Value pairs, but source is prefixing the text before Json data.
Please let us know the search string to extract json fields.
*************************************
2020-06-22 23:52:40,895 INFO [Timer-Driven Process Thread-10] o.a.nifi.processors.standard.LogMessage LogMessage[id=2202601e] TEST{
"domain": "ABC",
"module": "TEST",
"EventID" : "1233"
}
| makeresults
| eval _raw="2020-06-22 23:52:40,895 INFO [Timer-Driven Process Thread-10] o.a.nifi.processors.standard.LogMessage LogMessage[id=2202601e] TEST{
\"domain\": \"ABC\",
\"module\": \"TEST\",
\"EventID\" : \"1233\"
}"
| rex "(?ms)(?<json>{.*})"
| spath input=json
Is there a reason why you don't do as I said?
try rex and spath input=rex_field
I tried something like this but it is not working. can you please share the correct string
rex field=_raw "eventId=\"(?<eventId>.*)\"" | spath output=OpName path="eventId"
| makeresults
| eval _raw="2020-06-22 23:52:40,895 INFO [Timer-Driven Process Thread-10] o.a.nifi.processors.standard.LogMessage LogMessage[id=2202601e] TEST{
\"domain\": \"ABC\",
\"module\": \"TEST\",
\"EventID\" : \"1233\"
}"
| rex "(?ms)(?<json>{.*})"
| spath input=json
Is there a reason why you don't do as I said?
can you please share the rex command to extract the fields