I'm using the kv plugin to extract data from Windows ForwardedEvents. Typical data to process looks like:
Client Version: 220.127.116.11 Client Policy ID: e964d551-3d3c-4a8f-8b9c-a99cce9b7ce5 IP Addresses: 192.168.0.10 Process Name: MSIP.App Action: Download Policy
KV splits by ':' into, e.g.
Client Version" : "18.104.22.168"
I can't find a way to generate the fieldnames replacing the space and lowercasing, e.g.
"Client Version" -> "client_version"
There is a large number of fields to deal with so I would rather process them programatically than explicitly change each one by name.
Is there a way to do this?