How do you extract multiple key value pairs within a raw field?

[ameyapatil29]

Hello,

I want to extract key value pairs from logs that contain a particular search string.

Here is the example of the log
[INFO ] [2018-11-07 01:06:16 +0000] [69919359600740] connection_counter {22=>2, 29=>3, 16=>5, 21=>3, 14=>3}

I want to extract the key value pairs with "kvdelim" as "=>" and "pairdelim" as ", " and name it as "id" for key & "value" for value.

The two characters in "kvdelim" and "pairdelim" are considered as XOR not a combined unit.

Thanks,
-Ameya

[cpetterborg · Accepted solution]

Like this (use this exact search to see if the values are what you want)?:

| makeresults
| eval data="[INFO ] [2018-11-07 01:06:16 +0000] [69919359600740] connection_counter {22=>2, 29=>3, 16=>5, 21=>3, 14=>3}"
| rex field=data max_match=0 "(?<id>\d+)=>(?<value>\d+)"

[ameyapatil29]

Hello @cpetterborg, Thank you for replying to this query.

I had a similar rex query that I tried but it never extracts the values. My query was

index="xxxx"  host="xxxxx" connection_counter | rex field=_raw "connection_counter {(?<community_id>\d*)=>(?<connection_count>\d*)}" 
|  rex field=_raw "\[(?P<thread_id>\d{14})\]" 
| timechart span=1m sum(connection_count)

This doesn't extract the different keys(community_id) and values(connection_count) associated with those keys.

[ameyapatil29]

Ah correction, adding max_match extracts those values perfectly fine, Thank you @cpetterborg!

[cpetterborg]

I've moved the comment to an answer, so you can accept the answer if it has given you the answer that you need.

Thanks!