How could I make this pattern "a=b" from log files into 'a' as the key and 'b' as the value?

[Jennifer]

Hi, all!

How could I make this pattern "HKL20167991SIT_7_8299=true" from my log files into 'XXXX'(the last four digits) as the key and 'true/false' as the value?

Here's my log file:

HKL20167991SIT_7_8299=true, HKL20167991SIT_8_8260=true, HKL20167991SIT_4_8296=true, HKL20167991SIT_26_8274=true, HKL20167991SIT_32_827A=true, HKL20167991SIT_29_8277=true, HKL20167991SIT_35_827D=true, HKL20167991SIT_22_828E=true, HKL20167991SIT_24_8272=true, HKL20167991SIT_1_825A=true, HKL20167991SIT_31_8279=true, HKL20167991SIT_9_8261=true, HKL20167991SIT_11_8263=true, HKL20167991SIT_14_8266=true, HKL20167991SIT_27_8275=true, HKL20167991SIT_17_8269=true, HKL20167991SIT_37_827F=true, HKL20167991SIT_28_8276=true, HKL20167991SIT_34_827C=true, HKL20167991SIT_20_827C=true, HKL20167991SIT_25_8273=true, HKL20167991SIT_12_8264=true, HKL20167991SIT_15_8267=true, HKL20167991SIT_5_8297=true, HKL20167991SIT_19_826B=true, HKL20167991SIT_3_8295=true, HKL20167991SIT_10_8262=true, HKL20167991SIT_13_8265=true, HKL20167991SIT_18_826A=true, HKL20167991SIT_16_8268=true, HKL20167991SIT_33_827B=true, HKL20167991SIT_36_827E=true, HKL20167991SIT_2_825B=true, HKL20167991SIT_21_827D=true, HKL20167991SIT_23_828F=true, HKL20167991SIT_30_8278=true, HKL20167991SIT_6_8298=true

The result I need is:

Port	Status
8299	true
827D	true
8278	true

[ITWhisperer · Accepted solution]

Assuming that you have multiple entries in the same event, you could try something like this

| rex max_match=0 "_(?<portstatus>\d{4}\=\w+)"
| mvexpand portstatus
| rex field=portstatus "(?<port>\d{4})\=(?<status>\w+)"

[Jennifer]

Hi, IT whisperer!!!

I am very sorry that I didn't show the whole part of my log file:

2022-02-10 08:44:49,603|MjGp1a5-QCeTJzaLizErLEJ|INFO|log|Line availability Hashmap is {HKL20167991SIT_7_8299=false, HKL20167991SIT_8_8260=false, HKL20167991SIT_4_8296=false, HKL20167991SIT_26_8274=false}

2022-02-15 20:51:25,938|vPS567f3KpTgsw7mXARPbxS|INFO|log|Host availabilty Hashmap is {HKL20167984SIT_13_8225=true, HKL20167984SIT_7_82FB=true, HKL20167984SIT_2_82F6=true, HKL20167984SIT_16_8228=true}

I only want to extract the ports from Host availability! How could I rewrite the command?

[ITWhisperer]

There are a couple of ways to filter in those events

| regex _raw="Host availabilty Hashmap is"

or

| search "Host availabilty Hashmap"

These remove the events which don't have this string from the events pipeline, so, as long as you don't need these other events further in this search, either way should work

[PickleRick]

You have to first extract that part from the raw event

| rex "Host availabilty Hashmap is \{(?<payload>[^}]*)\}"
| rex max_match=0 field=payload "_(?<portstatus>\d{4}\=\w+)"
| mvexpand portstatus
| rex field=portstatus "(?<port>\d{4})\=(?<status>\w+)"