I've created a Field Transform that attempts to extract all JSON key-value pairs, via the following regex:
(?:\"|\')([^"])(?:\"|\')(?=:)(?::\s)(?:\")?(true|false|[0-9a-zA-Z()\@:\,\/!+-.\$\ \\']*)(?:\")?
It's extracting ALL Json Key Value Pairs, except for Array's.
I'm okay not capturing arrays for now.
The problem I'm having is due to the one-size-fits-all approach of this RegEx, I need to include Comma's within the value matching for some of our error logging, however, that's resulting in the comma being captured after non-quoted numerical fields, as shown here:
Without the \, in the second capture group, I can't get the entire 'About' message, which includes a comma.
With it, I pick up the comma's on non-quoted numerical fields.
I haven't given up, but thought I'd crowd source an answer if possible because I'm a couple hours deep in this now and thought maybe someone knows what's missing.
Note: We can't use the KV_Mode Json Auto-extractions because JSON data is embedded within other log data in unexpected places, so this is a simple "catch all" match we apply to a handful of sourcetypes.
Thanks for your help! Feel free to head to the URL in that image to play with the expression directly.
