Analysis to get key=value tokens

Elastic Stack Elasticsearch
1

Hello,

I can have message like this
Some object id=3 created by user=123

What is the best way to get tokens

id=3, user=123

after analysis?

I think about splitting with standard delimiters (with Tokenizer) excluding "=" and filtering (with Token Filters) everything that doesn't contain it.

But maybe there is another better way.
And if not, can I exclude everything that not contain "=" without regular expressions?

2

An alternative approach might be to split this data at indexing time in separate fields, so that you can actually query it as well as easily access it.

Take a look at the node ingest feature and specificially the grok processor

hope this helps!

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.