Extracting kv pars from a field in a json string

[brent_weaver]

I have a field in my JSON string like:

message: caas_tcp_est=12326 caas_bgp_est=0 caas_ovpn_elapsed=2288881 caas_ovpn_count=12318 caas_ovpn_memrss=7562140 mem_total=15657072 mem_free=5400856 mem_avail=7519920 cpu_util=3.43

How do I extract that iinto kvpairs? I see the extract command but dont understand know how it works.

[richgalloway]

The extract command works in two ways to parse data. One is to invoke a transform defined in your transforms.conf file. The other uses in-line arguments to specify how KV pairs should be parsed. You'll likely want to use the second method. Try this. It tells the extract command that keys are separated from their values by an equals sign and each KV pair is separated by a space.

... | extract kvdelim="=" pairdelim=" " | ...