parsekv

Parses a string consisting of key-value pairs.

Syntax

parsekv [field=TARGET_FIELD] [kvdelim="CHAR"] [overlay=BOOL] [pairdelim="CHAR"]
Optional Parameters
field=TARGET_FIELD
Field to be parsed in the input data stream (default: line).
kvdelim="CHAR"
Character to use as the key-value delimiter (default: =).
overlay=BOOL
Option to control data-overwrite (default: f).
  • t: Outputs both the parsed data and the original data.
  • f: Outputs the parsed data only.
pairdelim="CHAR"
Delimiter that separates the key-value pairs(default: space).

Usage

Convert the JSON string in the line field into a key-value pair.

json "{line: 'src=1.2.3.4 src_port=55324 dst=5.6.7.8 dst_port=80'}"
| parsekv kvdelim="=" pairdelim=" "