a processing rule would look like:
rule "kv_ex_prefix"
when
has_field("kv")
then
// extract all key-value from "message" and prefix it with kv_
set_fields(
fields:
key_value(
value: to_string($message.message),
trim_value_chars: "\""
),
prefix: "kv_"
);
end
This would also strip out the "
if present.