I have a log I can mostly parse w/ the KV filter. I have a few fields that aren't parsing correctly though as the values are a list instead of a single value. For example:
..., rand_key: rand_value, IP Address: (192.168.1.1, 192.168.1.2, 192.168.1.3), rand_key2: rand_val2, ...
I'd like to be able to preserve the IP addresses as an IP data type, not a string. Currently I get an error in logs saying IP Address is not an IP string literal and it appears the message is not indexed.
Ideally, this would parse into duplicate keys (e.g. IP_Addr), in the same document, each with a different value, but I don't know that this is possible. I can grok this out into IP_Addr1, IP_Addr2, IPAddr3, and drop empty fields, but I'm hoping there's a cleaner, simpler option using the KV filter.
Anyone have any suggestions?