Given the example filter inputs "[Key1:/app/segment/confirm.jsp] 21:50:00 [Key2:3] [Key3:93] [Key4:392] [Key5:210] [Key6:144] [Key7:93] [Key8:392] Some more text that should not be included in key value"
I need to extract the key value pairs between the brackets [ ] , however, can't find a way to trim away the exes characters after ending bracket ] . Number of keys are dynamic so cant use grok to extract what I want.
KV filter looks like this now:
source => "message"
value_split => ":"
field_split => "["
include_brackets => false
trimkey => " "
was looking to add a trim setting with a regex to remove all chars including ] until the next [ , but this does not seem possible.
Any other approaches to take on this problem? Guess I could look to extract alle the key value segments first with a regex like this [(?.?)(?::(?.?))?] but cant see how to do that.
Any help is much appreciated