After using grok and mutate filters, I have a field called
headers containing following value
accept-encoding=[gzip,deflate], breadcrumbId=[ID-fuse1-51739-1547625048671-0-6180], Host=[localhost:9000], JMSCorrelationID=[Camel-ID-fuse3-56675-1547627177108-9-21], User-Agent=[Apache-HttpClient/4.1.1 (java 1.5)], wsErrorCode=[WS002], wsErrorMsg=[ESB Connection Timeout]
I want to extract the value from the key
breadcrumbId. i.e. I want
ID-fuse1-51739-1547625048671-0-6180 and put it into the field UniqueProcessId.
I am using following syntax
source => "headers"
field_split => ","
include_brackets => "true"
remove_char_value => ","
include_keys => [ "breadcrumbId"]
target => "UniqueProcessId"
The breadcrumId's value is not being set to the target. The UniqueProcessId's value is blank. There is no parsing error.
I tried with and without target options. Both not working.
Am I using the KV filter correctly? Is it because one of the key's value contains a
Appreciate any help.