Parsing message using kv filter

[toms130 (thomas)]

Hi all,

I'd like to parse some part of a message with VKv filter, and keep end of the message into another field.

Message is :
[MarketplaceGroup=data][MarketplaceId=10][AccountId=1234] updating 926 items

My filter is :
filter {
kv {
source => "message"
field_split_pattern => "\]\["
trim_key => "\[\]"
trim_value => "\[\]"
}
}

Result I have is :
{
"MarketplaceGroup" => "data",
"@timestamp" => 2020-02-13T17:15:30.615Z,
"MarketplaceId" => "10",
"AccountId" => "1234] updating 926 items",
"message" => "[MarketplaceGroup=data] [MarketplaceId=10] [AccountId=1324] updating 926 items"
}

result I'd like to have is :

{
"MarketplaceGroup" => "data",
"@timestamp" => 2020-02-13T17:15:30.615Z,
"MarketplaceId" => "10",
"AccountId" => "1234",
"message" => "updating 926 items"
}

I can't find how to define all my key/values are inside braces, and rest of field is what I want to keep in message field (or store in another field, whatever)

thanks
thomas

[Badger]

I would

mutate { copy => { "message" => "otherMessage" } }
mutate { gsub => [ "message", "[^\]]*$", "", "otherMessage", ".*\]([^\]]*)$", "\1" ] }

then kv the [message] field.

[toms130 (thomas)]

@Badger

I would

mutate { copy => { "message" => "otherMessage" } }
mutate { gsub => [ "message", "[^\]]*$", "", "otherMessage", ".*\]([^\]]*)$", "\1" ] }

then kv the [message] field.

Ah, regex magic, it works like a charm!
thanks badger