kvjoin()

Concatenates all keys and values ​​into a single string.

Syntax

kvjoin(KV_DELIMIT, PAIR_DELIMIT[, REGEX])
Required Parameter
KV_DELIMIT
String that delimits the key and the value.
PAIR_DELIMIT
String that delimits each key-value pair.
Optional Parameter
REGEX
Regular expression to match against the key. The function concatenates a key and a value only if the key matches the regular expression. If you do not specify the expression, the function concatenates all key-value pairs.

Usage

  1. Combine strings by using colons (:) as key-value delimiter and ^ as a key-value pair delimiter.

    json "{}" 
    | eval name="Kim", age=30 
    | eval result=kvjoin(":", "^") => "name:Kim^age:30"
    
  2. Concatenate strings using colons (:) as key-value delimiter and ^ as a pair delimiter by extracting only fields that match src.* regular expression.

    json "{
        'src_ip':'1.2.3.4', 'src_port':45667,
        'dst_ip':'5.6.7.8', 'dst_port':80,
        'protocol':'TCP'
    }" 
    | eval result=kvjoin(":", "^",  "src.*")
    => "src_ip:1.2.3.4^src_port:45667"