Extract field value

[vintik]

Hello,

Could anybody assist with this question - what method is the best to extract to new field value of "animal" key? Should I use eval or searchmatch or something else?

Here is example:

[some_date] ..."application":"some_app", "animal":"dog","segment":....
[some_date] ..."application":"some_app", "animal":"cat","segment":....

I need this variable to use in stats.

[althomas]

If it's json, use spath

Otherwise you can do something like this:

transforms.conf:

[my_kv_transform]
FORMAT = $1::$2
REGEX = \"([^"]+)\":\"([^"]+)\"

props.conf

[my_sourcetype]
REPORT-my_sourcetype_kv = my_kv_transform

This should do search-time extractions to get animal=dog and application=someapp

[FrankVl · Accepted solution]

This should work:
| rex "\"animal\":\"(?<animal>[^\"]+)\""

Alternatively, you could try the following to apply key value extractions on your events. Whether this works properly depends on what exactly your full data looks like, but might be worth playing around with.
| extract pairdelim=",", kvdelim=":"