I have the following log :
data=123 params="{"limit":200,"id":["123"] someotherdata
How can I parse the params field to a table so that the final output is
data | params |
123 | "{"limit":200,"id":["123"] |
if I try table data params
It ends up being :
data | params |
123 | { |
You already have the data field, so we'll use the rex command to extract the param field. I'll assume the field ends with the first space.
... | rex "params=(?<params>\S+)"
| table data params