Hello, I have log lines that may report key:value pair out of order.
2016-06-01 08:52:52 [info]: key1:value1, key2:value2
2016-06-01 08:52:52 [info]: key3:value3, key2:value2
2016-06-01 08:52:52 [info]: key2:value2, key1:value1, key3:value3
I can find key:value pairs using below grok pattern a) if they appear in right order b)and they are for sure present
%{TIMESTAMP_ISO8601:timestamp} [%{WORD:logLEVEL}]: key1:%{WORD:value1}, key2:%{WORD:value2}
I want to be able to capture out of order and optionally skup some fields as well. As a result, I would like to create following object.
Line#1
{
"timeStamp": "2016-06-01 08:52:52",
"logLEVEL":"info",
//all key value pairs mentioned
"key1":"value1",
"key2":"value2"
}
Line#2
{
"timeStamp": "2016-06-01 08:52:52",
"logLEVEL":"info",
//all key value pairs mentioned
"key3":"value3",
"key2":"value2"
}
Line#3
{
"timeStamp": "2016-06-01 08:52:52",
"logLEVEL":"info",
//all key value pairs mentioned
"key1":"value1",
"key2":"value2",
"key3":"value3"
}