Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Generic field names for non KV pairs in KV parsing #525

Open
Dylan-M opened this issue Jan 17, 2022 · 0 comments
Open

Generic field names for non KV pairs in KV parsing #525

Dylan-M opened this issue Jan 17, 2022 · 0 comments
Labels
enhancement New feature or request

Comments

@Dylan-M
Copy link
Contributor

Dylan-M commented Jan 17, 2022

We have a mixed dataset, separated by pipes (see #524 ). Most of it is Key Value pairs, however some of them are just single words. It would be nice, if the Key Value parser would assign generic field names based on position within the array based on the delimiter.
<30>Jan 10 21:23:41 mahcaproxy1 mwg: LEEF:1.0|McAfee|Web Gateway|9.2.16|0|devTime=1641849821000|usrName=caapm|realm=mahedeamdmz-vip.ups.com|src=10.220.2.12|srcPort=20331

From the example snippet above, the output I would like to see would be this mix of generic field names and named fields:
field0: <30>Jan 10 21:23:41 mahcaproxy1 mwg: LEEF:1.0
field1: McAffee
field2: Web Gateway
field3: 9.2.16
field4: 0
devTime: 1641849821000
usrName: caapm
realm: mahedeamdmz-vip.ups.com
src: 10.220.2.12
srcPort: 20331

Currently using regex parsing due to this and #524.

@Dylan-M Dylan-M added the enhancement New feature or request label Jan 18, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant