Key_value - remove space in field portion

I have a key_value result but the fields portion have spaces that I need to convert to underscore to use the set_fields() function. I can use regex_replace -but- the regex I have matches on spaces in the key and value portion. So for instance:

client os version=microsoft windows 10 pro 64-bit



when what I want is:

client_os_version=microsoft windows 10 pro 64-bit

The usable but not optimal regex with example data (


{user name=b.oaks, config name=corp-epointsetting, private ip=, client region=us, client ip=, client version=5.0.0-87, device name=zz-777, client os version=microsoft windows 10 pro 64-bit, vpn type=device level vpn}
I could grok it (as I erroneously suggested on an earlier post by someone else with a similar quest) but then I would have to create one for each possible key_value that comes in… bleh.

What would you do?

he @tmacgbay

for the long run I would add a feature request - to have the option in Key-Value function to replace not allowed characters in key.

Would make more sense to have special characters handled in set_fields() and set_field()? - that way it would also catch any other data coming through from grok (etc.) would be massaged appropriately.

key_value() still works with the spaces, it’s when you are creating the fields that it chokes.

thx for the issue:

and you are right about the idea you have!

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.