To extract fields from a query string

Elastic Stack Logstash
1

Assume that there is a field like:

Cmd=FolderSync&User=ABC&DeviceId=androidc737881212&DeviceType=Android&Log=V141

I can use mutate to split the field into an array.
it will just like ['Cmd=FolderSync....]
But I want to convert the array to a json-like object like:

{
  “Cmd”: "FolderSync",
  ...
}

Or convert to fileds.
Is there any way can do this?

2

Use a kv filter. Its documentation contains an example of exactly what you want to do.

3

If kv conflicts with grok? Because I am trying to use grok parse the log. And then addressing the query field to jsonify.

4

If kv conflicts with grok?

It's not clear what you mean by this. Please give an example.

5

I have tried, it works. Thanks.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.