- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

We are importing structured logs stored as json lines in a text file. An example event:
{ "time": "...", "template": "User {Username} logged into {Application}", "Username": "John.Doe", "Application": "SomeApp" }
I am looking to render the template into a message property that would read "User John.Doe logged into SomeApp" by replacing the tokens with values from their respective properties.
The template and properties are dynamic, so I cannot hard code the property names in the regex. Is there a way to perform this rendering dynamically either during log ingestion or during search time?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Try something like this:
| makeresults
| eval _raw="{ \"time\": \"...\", \"template\": \"User {Username} logged into {Application}\", \"Username\": \"John.Doe\", \"Application\": \"SomeApp\" }"
| spath
| foreach *
[| eval template=if("<<FIELD>>"="template",template,replace(template,"\{"."<<FIELD>>"."\}",<<FIELD>>))]
The first two lines just set up some dummy data.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Thank you so much!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Try something like this:
| makeresults
| eval _raw="{ \"time\": \"...\", \"template\": \"User {Username} logged into {Application}\", \"Username\": \"John.Doe\", \"Application\": \"SomeApp\" }"
| spath
| foreach *
[| eval template=if("<<FIELD>>"="template",template,replace(template,"\{"."<<FIELD>>"."\}",<<FIELD>>))]
The first two lines just set up some dummy data.
