Extract data in log event as key value pair

[galbrilovich]

Hi, I am trying to extract data from my logs to display it by time.

My logs look in this form:

2020-09-09 14:45:46.321 finished processing data- sold 5 products: 2(<product1>) 1(<product2>) 2(<product3>).
i want to show it as a timechart when 3 of the products are shown with each of their values:
2 sales for <product1>, 1 for <product2> and 2 for <product3>, how can i do it for each log?
Note: in a log there can be shown n different products.

[richgalloway · Accepted solution]

Try this query.

| makeresults | eval _raw="2020-09-09 14:45:46.321 finished processing data- sold 5 products: 2(<product1>) 1(<product2>) 2(<product3>)."
```Above just defines test data```
| rex max_match=0 "(?<quantity>\d+)\((?<product>[^\)]+)\)[\.\s+]"
| eval combo = mvzip(product, quantity)
| mvexpand combo
| eval combo = split(combo, ",")
| eval product=mvindex(combo, 0), quantity=mvindex(combo,1)
| timechart sum(quantity) as Sales by product

[galbrilovich]

thank you very mush, it works! 🎉