Is it possible to use the rex command to do a dynamic key=value extraction where they key is a also a regular expression?
I know this can be done with a transform using:
REGEX = (,*?)=(.*?)
FORMAT = $1::$2
Can I do the same thing using rex instead? Maybe something like:
rex field=_raw "(?P<\\FIELDNAME>.*?)=(?<\\VALUE>.*?)"
Is their something I'm missing in the group naming syntax?
I'm looking for a way to do this at search-time rather than index-time without writing a transform.
I don't know how to do this with rex, but have you looked at using the DELIMS key word in transforms.conf? If there is a regular pattern in your data that defines fields
then you can specify that with
DELIMS = " ", ":"
More details re: transforms.conf are here Take a look at the examples at the very end of the page.