How can I extract multiple fields and values from the following raw information?

[edwinmae]

I have raw information as follows: Two times Kaspersky output within one 'section'

------------------------------------------------------------ snip of one section --------------------------------------------------------------------

08/11/2018
07:43:58.000

kaspersky output:
Scanned objects : 19
Total detected objects : 0
Infected and other objects : 0
Disinfected objects : 0
Moved to backup : 0
Removed objects : 0
Not disinfected objects : 0
Scan errors : 0
Corrupted objects : 0
Password protected objects : 0
Skipped : 0

Between the above/below output are many lines with all kind of information that is not really relevant

kaspersky output:
Scanned objects : 1
Total detected objects : 0
Infected and other objects : 0
Disinfected objects : 0
Moved to backup : 0
Removed objects : 0
Not disinfected objects : 0
Scan errors : 0
Corrupted objects : 0
Password protected objects : 0
Skipped : 0

And then there are many lines in the bottom that is not really relevant as well

------------------------------------------------------------ snip of one section --------------------------------------------------------------------

Target is to have e.g. a time table with the values of each line, e.g. field value would be e.g. "Scanned objects" and its value would be 19 and 1 (in this case) -- and then similar approach for all the other lines --

I tried to extract the fields using the Regular Expression, but it seems it does not select every value (of e.g. Scanned objects), meaning I have blanks in the output itself

Please advise how to actually get this done

[493669 · Accepted solution]

Hi @edwinmae,
try kv extraction below-

....|kv  mv_add=true pairdelim="\r\n",kvdelim=":"

It will separate key value pair

[edwinmae]

That actually seems to work

There are still blanks in the output which is likely caused by the raw data within the same 'section' that contains e.g. s3://xxxx or https:// , so these are also seen as 'pairs' ...

Is there a way exclude them from the output?

Now they have no value

[493669]

you can remove fields using

|fields - <fieldname>