Extract into json objects together with the other _raw.items and rename the field
Hello all, I need some help please. I have some data in _raw.body, and I'd like to extract the them into json objects together with the other _raw.items (such as _raw.ctupdate) I'd also like to rename some of the fields. Any suggestions?
Answers
-
It looks like body has some Key:Value pairs. Have you tried using a Parser() function w/source field of _raw and Type of Delimited values? Where delimiter is `:`.
0 -
Regex is better for that use case
0 -
0
-
I'm glad you posted that <@U01C35EMQ01>. I will be needing that in the future. It's very similar to Splunk's method, so I'm glad to see it's available the same way. :slightly_smiling_face: :skin-tone-2:
0 -
Thanks <@U01C35EMQ01>. I tried the solution, but get KEY_0: {"body" as an output
0 -
I Dm'd you a zoom
0 -
sure
0 -
All fixed!
0 -
The world would be a better place with nicely formatted input. I don't think that David has met a poorly formatted input that he could not tame with Stream.
0