Extract jSON formated data

[sathiyasun]

below is the sample json log content the main filelds are default extracts but the nested aren't. Please help to extract the nested space separated data as fields

The one I want to extract as a separate field is the line


tag: service=z2-qa1-local-z2-api-endpoint APPID=1234 cluster=z2-qa1-local application=z2 full-imagename=0123456789.dkr.10cal/10.20/xyz container-id=asdfgh503 full-container-id=1234567890

Whole log event
{ [-]
line: { [-]
@timestamp: 2023-10-31T20:36:57.092Z
class: x.x.x.x.x.Logging
exception:
line: 54
marker:
message: GET https://00.00.000.000:123456/management/health forwarded from [] by [] for unknown returned 200 in 1ms
pid: 7
severity: INFO
span: b60d05680b3cbfa7
thread: boundedElastic-9
trace: b60d05680b3cbfa7
}
source: stdout
tag: service=z2-qa1-local-z2-api-endpoint APPID=1234 cluster=z2-qa1-local application=z2 full-imagename=0123456789.dkr.10cal/10.20/xyz container-id=asdfgh503 full-container-id=1234567890
}

[yuanliu]

As @ITWhisperer said, illustrate structured data in raw format, not with Splunk's condensation.

If you already have a top level key "tag", I suspect that you actually want the key-value pairs in that value ("service=z2-qa1-local-z2-api-endpoint APPID=1234 cluster=z2-qa1-local application=z2 full-imagename=0123456789.dkr.10cal/10.20/xyz container-id=asdfgh503 full-container-id=1234567890") extracted, not to extract that line again.  Maybe the key "tag" is not top level.  In that case, you will need to tell us what is the path leading to tag.  In all cases, raw format will help volunteers diagnose.

If "tag" is top level, you can use kv (aka extract) to extract fields like service, APPID, etc., like

| rename _raw AS temp, tag AS _raw
| kv
| rename _raw AS tag, temp as _raw

Your sample should give

APPID	application	cluster	container_id	full_container_id	full_imagename	service
1234	z2	z2-qa1-local	asdfgh503	1234567890	0123456789.dkr.10cal/10.20/xyz	z2-qa1-local-z2-api-endpoint

Is this something you are looking for?

[ITWhisperer]

Please share the raw, unformatted event in a code block </> to preserve raw formatting.