Extracting "bean string" formatted logs

[jhart_rapid7]

I have some log entries that look like the following:

 foo2011-06-25T20:12:54 [a.b.c.d] Promoting SystemFingerprint [[architecture=null][certainty=0.8][description=Sun Solaris][deviceClass=null][family=Solaris][product=Solaris][vendor=Sun][version=null]] source: NTP

In some (all?) cases, when the default extractions happen, fields that have whitespace don't appear to be extracting correctly. For example, I would like 'description' from the above example to be 'Sun Solaris', however it is 'Sun'. I have tried the following with extract:

extract pairdelim="\]\[", kvdelim="=" auto=f

One workaround I have used is to use rex to pull out all of the fields, however the format for these logs isn't always the same (there may be more key value pairs, sometimes in a different order).

Any ideas?

[ziegfried · Accepted solution]

The following should work:

props.conf

[your_sourcetype]
REPORT-bean-kv = extract-bean-kv
KV_MODE = none

transforms.conf

[extract-bean-kv]
REGEX = \[([^=\]]+)=([^=\]]+)\]
FORMAT = $1::$2
CLEAN_KEYS = true

[jhart_rapid7]

Perfect. Thank you.