Issue with Key=Value Parser Pipeline for specific log-messages

Try to use this, I’ve added parameters to remove "{} from key and values. But, it’s not perfect, because of Country contains json.

rule "key_value_parser"
when
    has_field("Full_Response")
then
    set_fields(
        fields:
            key_value(
                value: to_string($message.Full_Response),
                delimiters:",",
                kv_delimiters:":",
                trim_key_chars:"\"",
                trim_value_chars: "\"{}")
            );
end
1 Like