Replace placeholders in message templates with property values

[nathanjr]

We are importing structured logs stored as json lines in a text file. An example event:

{ "time": "...", "template": "User {Username} logged into {Application}", "Username": "John.Doe", "Application": "SomeApp" }

I am looking to render the template into a message property that would read "User John.Doe logged into SomeApp" by replacing the tokens with values from their respective properties.

The template and properties are dynamic, so I cannot hard code the property names in the regex. Is there a way to perform this rendering dynamically either during log ingestion or during search time?

[nathanjr]

Thank you so much! 

[ITWhisperer · Accepted solution]

Try something like this:

| makeresults 
| eval _raw="{ \"time\": \"...\", \"template\": \"User {Username} logged into {Application}\", \"Username\": \"John.Doe\", \"Application\": \"SomeApp\" }"


| spath
| foreach *
    [| eval template=if("<<FIELD>>"="template",template,replace(template,"\{"."<<FIELD>>"."\}",<<FIELD>>))]

The first two lines just set up some dummy data.