How to Extract Values from a KV within a event log

[vickyvishwa]

I have the below log event.

[INFO ] 2019-01-24T04:09:20,513 [thread=framework1234] className=DummyConsumer - {} - {topic=events-1, timestamp=12233344433, timestampType=CREATE_TIME, value={msg_id=bdb95851-1fd0-11e9-a1b3-yhgt6465783gh, ip=127.0.0.1, timestamp=2019-01-24 04:08:50.0}, logMessage=Event Processed, failure=F}

I have to extract timestamp and ip both of them inside value key. What is the best way to do that. I tried multiple extract commands nothing works (or probably I am doing wrong).

[vnravikumar]

Hi @vickyvishwa

Please Try

| makeresults 
| eval log=" [INFO ] 2019-01-24T04:09:20,513 [thread=framework1234] className=DummyConsumer - {} - {topic=events-1, timestamp=12233344433, timestampType=CREATE_TIME, value={msg_id=bdb95851-1fd0-11e9-a1b3-yhgt6465783gh, ip=127.0.0.1, timestamp=2019-01-24 04:08:50.0}, logMessage=Event Processed, failure=F}" 
| rex field=log "ip=(?P<ip>.*),\stimestamp=(?P<timestamp>.*)}," 
| table ip,timestamp

[harsmarvania57 · Accepted solution]

Hi,

Please try below regex, this will extract values in two fields timestamp and ip

<yourBasesearch> | rex field=_raw "ip=(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\,\stimestamp=(?<timestamp>[^}]*)"