Is there a way to extract the key-value pair in the JSON object from the _raw field in the Pipeline?
Hi, is there a way to extract the key-value pair in the JSON object from the `_raw` field in the Pipeline? My `_raw` field looks like this `_raw: {"name":"foo", "age":"99", "phone":"12345678"}` I've tried the Parser function in the Pipeline, and tried the options in the Type dropdown but no luck... The parse extraction example in the sandbox tutorial is in string, didn't work for dictionary.
Answers
-
Can you share a Screenshot of how your sample actually looks in Cribl preview?
0 -
it's a script that returns a dictionary:
0 -
Does that JSON file LINT properly?
0 -
The JSON standard requires double quotes and will not accept single quotes, nor will the parser.
0 -
Your raw has single quotes.
0 -
Thats likely a python dict, not JSON
0 -
0
0 -
`'(?<_KEY_0>.+?)':'(?<_VALUE_0>.+?)'`
0 -
Just use the REGEX Function
0 -
<@U041MGED76H> Does that make sense?
0 -
Thanks, both! Well spotted and quick solution! I'll give that a go! :pray:
0 -
If you can modify that script, it's effectively just wrapping the output in json.dumps().
0 -
Clearly the better long term solution ^^
0
