parsekv

Parses a key-value pair string in a text field and extracts each key as a field.

Command properties

Syntax

Options

field=FIELD

Name of the field to parse (default: line)

overlay={t|f}

When set to t, preserves the original record's fields and overlays the parsed fields onto them. When omitted, outputs only the parsed fields. (default: f)

pairdelim=DELIM

String used to delimit key-value pairs. Cannot be empty. (default: " ")

kvdelim=DELIM

String used to delimit keys and values. Cannot be empty. (default: "=")

Error codes

Parse errors

Description

The parsekv command splits the string in the specified field using pairdelim, then splits each token into a key and value using kvdelim, and extracts each as a field.

Examples

1. Parsing basic key-value pairs

   json "{'line': 'src=192.0.2.1 src_port=55324 dst=198.51.100.2 dst_port=80'}"
   | parsekv
   

   Parses space-delimited key=value pairs and creates the src, src_port, dst, and dst_port fields.

2. Parsing with custom delimiters

   json "{'line': 'name:logpresso;version:4;type:siem'}"
   | parsekv pairdelim=";" kvdelim=":"
   

   Uses semicolons (;) to delimit pairs and colons (:) to delimit keys and values.