kvjoin()
Concatenates all keys and values into a single string.
Syntax
kvjoin(KV_DELIMIT, PAIR_DELIMIT[, REGEX])
Required Parameter
KV_DELIMIT
- String that delimits the key and the value.
PAIR_DELIMIT
- String that delimits each key-value pair.
Optional Parameter
REGEX
- Regular expression to match against the key. The function concatenates a key and a value only if the key matches the regular expression. If you do not specify the expression, the function concatenates all key-value pairs.
Usage
-
Combine strings by using colons (
:
) as key-value delimiter and^
as a key-value pair delimiter.json "{}" | eval name="Kim", age=30 | eval result=kvjoin(":", "^") => "name:Kim^age:30"
-
Concatenate strings using colons (
:
) as key-value delimiter and^
as a pair delimiter by extracting only fields that matchsrc.*
regular expression.json "{ 'src_ip':'1.2.3.4', 'src_port':45667, 'dst_ip':'5.6.7.8', 'dst_port':80, 'protocol':'TCP' }" | eval result=kvjoin(":", "^", "src.*") => "src_ip:1.2.3.4^src_port:45667"