parsekv
Parses a string consisting of key-value pairs.
Syntax
parsekv [field=TARGET_FIELD] [kvdelim="CHAR"] [overlay=BOOL] [pairdelim="CHAR"]
Optional Parameter
field=TARGET_FIELD
- Field to be parsed in the input data stream (default:
line
). kvdelim="CHAR"
- Character to use as the key-value delimiter (default:
=
). overlay=BOOL
- Option to control data-overwrite (default:
f
).t
: Outputs both the parsed data and the original data.f
: Outputs the parsed data only.
pairdelim="CHAR"
- Delimiter that separates the key-value pairs(default: space).
Usage
Convert the JSON string in the line field into a key-value pair.
json "{line: 'src=1.2.3.4 src_port=55324 dst=5.6.7.8 dst_port=80'}"
| parsekv kvdelim="=" pairdelim=" "