Key_value - remove space in field portion

Graylog Central (peer support)
1

I have a key_value result but the fields portion have spaces that I need to convert to underscore to use the set_fields() function. I can use regex_replace -but- the regex I have matches on spaces in the key and value portion. So for instance:

client os version=microsoft windows 10 pro 64-bit

becomes

client_os_version=microsoft_windows_10_pro_64-bit

when what I want is:

client_os_version=microsoft windows 10 pro 64-bit

The usable but not optimal regex with example data (https://regex101.com/r/W3kxCd/1)

(?=\b\s+)\s

{user name=b.oaks, config name=corp-epointsetting, private ip=10.42.7.207, client region=us, client ip=75.75.58.65, client version=5.0.0-87, device name=zz-777, client os version=microsoft windows 10 pro 64-bit, vpn type=device level vpn}
.
I could grok it (as I erroneously suggested on an earlier post by someone else with a similar quest) but then I would have to create one for each possible key_value that comes in… bleh.

What would you do?

2

he @tmacgbay

for the long run I would add a feature request - to have the option in Key-Value function to replace not allowed characters in key.

3

Would make more sense to have special characters handled in set_fields() and set_field()? - that way it would also catch any other data coming through from grok (etc.) would be massaged appropriately.

key_value() still works with the spaces, it’s when you are creating the fields that it chokes.

4

thx for the issue:

and you are right about the idea you have!

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.