How to change my data to kv in Logstash

The source data format cannot be changed

First stroke:
{value=12123, key=ABC2}, {value=2223, key=AB21C}, {value=1243, key=A4B1C}, {value=15223, key=AB35C}, {value=122123, key=A24BC}, {value=122213, key=AB33C}, {value=223, key=AB34C}, {value=123, key=A1B2C}, {value=615223, key=A2BC3}, {value=12423, key=AB5C1}

Secord:
{value=22323, key=AB21C}, {value=124, key=A4B1C}, {value=5223, key=AB35C}, {value=12223, key=A24BC}, {value=22153, key=AB33C}

How to change for kv format ,as follows
ABC2=12123,AB21C=2223,A4B1C=1243,AB35C=15223,A24BC=122123,AB33C=122213,AB34C=223,A1B2C=123,A2BC3=615223,AB5C1=12423

Thanks for responding

I would do that in ruby

    ruby {
        code => '
            m = event.get("message").scan(/value=(\w+), key=(\w+)/)
            s = ""
            m.each { |x|
                s += "#{x[1]}=#{x[0]},"
            }
            event.set("message", s.chomp(","))
        '
    }
1 Like

Thanks Badger , is solved

Badger , i have other question

if key and value include - (dash)

Dashes appear randomly in Key and Value

the source data like this
{value=app2.suint999.com, key=X-CDN-ANDROID-NONE}, {value=lt2.xfe1.com, key=X-CDN-LT-AB-C}, {value=no-cache, key=Pragma}

Thanks for responding

Try changing /value=(\w+), key=(\w+)/ to /value=([\w\-]+), key=([\w\-]+)/

1 Like

Badger , Thanks for your help
This is great
All solved

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.