How to split single field into multiple with different format?

[Praveenrocky]

Hi All,

i have events like below and i want to extract the fields as TotalRecords, SuccessRecords, FailedRecords, Batch, SuccessRecords, FailedRecords,BatchSize, Success, Failed. if the data not there for the even it should show as blank or null.

Item InsertStatus= 'TotalRecords': 1 'SuccessRecords': 1 'FailedRecords': 0
Entity: DevOpsItemAttribute records Batch 1 SuccessRecords=1 FailedRecords=0
EntityData Entity Delete Status BatchSize=50000 Success=26 Failed=0

my output should be like below.

TotalRecords, SuccessRecords, FailedRecords, Batch, SuccessRecords, FailedRecords,BatchSize, Success, Failed

1,1,0,null,null,null,null,null

null,null,null,1,1,0,null,null,null

null,null,null,null,null,null,50000,26,0

[bowesmana]

Use rex command - assuming your field is the _raw field, then this will work

| rex "TotalRecords':\s+(?<TotalRecords>\d+)\s+'SuccessRecords':\s+(?<SuccessRecords>\d+)\s'FailedRecords':\s(?<FailedRecords>\d+)"
| rex "Entity: DevOpsItemAttribute records Batch (?<Batch>\d+) SuccessRecords=(?<SuccessRecords2>\d+) FailedRecords=(?<FailedRecords2>\d+)"
| rex "EntityData Entity Delete Status BatchSize=(?<BatchSize>\d+) Success=(?<Success>\d+) Failed=(?<Failed>\d+)"
| table TotalRecords SuccessRecords FailedRecords Batch SuccessRecords2 FailedRecords2 BatchSize Success Failed
| fillnull value="null"

[bowesmana]

Note: you cannot have the same field name twice - in your example, so the second rex will call those fields SuccessRecords2 and FailedRecords2