Help me to parse a string to fields (grok)

Elastic Stack Elasticsearch
#1

Hi folks,

I have following key:

key = "value1/value2/value3"

or

key = "value1/value2/value3/value4"

I want to split this to following structure:

key1: value1
key2: value2
key3: value3

This would be easy by using a grok like

%{WORD:key1}/%{WORD:key2}/%{GREEDYDATA:key3} (greedydata because I want to get everything after value3 in one field).

However this works only when there is the delimiter "/" at the end of the string I cannot manage to make this grok work for both scenarios: When there are 3 values ore more than 3. Do you have an Idea how I can make this grok work?

#2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.