Field-extraction on a JSON message with multiple delimiters?

[jayakumar89]

I have this:

{"date": null, "facility": -1, "host": null, "level": -1, "message": "2017-11-13T03:45:00+0000 monStatsLog, applianceName=xxxxx, tenantName=xxxx, mstatsTimeBlock=1510544700, tenantId=1, vsnId=0, mstatsTotSentOctets=250, mstatsTotRecvdOctets=0, mstatsTotSessDuration=26001, mstatsTotSessCount=1, mstatsType=sdwan-acc-ckt-app-stats, mstatsId=tftp:Controller1:MPLS:1:2, mstatsAttribs=1:3:general-internet:file-server:Unknown", "charset": "UTF-8", "remote_address": "xxxxxxx", "hostname": "xxxxxx"}

I'm trying to parse a json file with entries like above, where the message field has multiple values, which are in turn delimited using comma and =. How can I parse that specific field to extract all the information?

[woodcock]

Assuming that your JSON is coherent and being processed correctly you should already have a message field so just do this:

| makeresults 
| eval message="2017-11-13T03:45:00+0000 monStatsLog, applianceName=xxxxx, tenantName=xxxx, mstatsTimeBlock=1510544700, tenantId=1, vsnId=0, mstatsTotSentOctets=250, mstatsTotRecvdOctets=0, mstatsTotSessDuration=26001, mstatsTotSessCount=1, mstatsType=sdwan-acc-ckt-app-stats, mstatsId=tftp:Controller1:MPLS:1:2, mstatsAttribs=1:3:general-internet:file-server:Unknown"

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| rename message AS _raw
| kv

[jayakumar89]

It helped. Thanks!