You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We have a mixed dataset, separated by pipes (see #524 ). Most of it is Key Value pairs, however some of them are just single words. It would be nice, if the Key Value parser would assign generic field names based on position within the array based on the delimiter. <30>Jan 10 21:23:41 mahcaproxy1 mwg: LEEF:1.0|McAfee|Web Gateway|9.2.16|0|devTime=1641849821000|usrName=caapm|realm=mahedeamdmz-vip.ups.com|src=10.220.2.12|srcPort=20331
From the example snippet above, the output I would like to see would be this mix of generic field names and named fields:
field0: <30>Jan 10 21:23:41 mahcaproxy1 mwg: LEEF:1.0
field1: McAffee
field2: Web Gateway
field3: 9.2.16
field4: 0
devTime: 1641849821000
usrName: caapm
realm: mahedeamdmz-vip.ups.com
src: 10.220.2.12
srcPort: 20331
Currently using regex parsing due to this and #524.
The text was updated successfully, but these errors were encountered:
We have a mixed dataset, separated by pipes (see #524 ). Most of it is Key Value pairs, however some of them are just single words. It would be nice, if the Key Value parser would assign generic field names based on position within the array based on the delimiter.
<30>Jan 10 21:23:41 mahcaproxy1 mwg: LEEF:1.0|McAfee|Web Gateway|9.2.16|0|devTime=1641849821000|usrName=caapm|realm=mahedeamdmz-vip.ups.com|src=10.220.2.12|srcPort=20331
From the example snippet above, the output I would like to see would be this mix of generic field names and named fields:
field0: <30>Jan 10 21:23:41 mahcaproxy1 mwg: LEEF:1.0
field1: McAffee
field2: Web Gateway
field3: 9.2.16
field4: 0
devTime: 1641849821000
usrName: caapm
realm: mahedeamdmz-vip.ups.com
src: 10.220.2.12
srcPort: 20331
Currently using regex parsing due to this and #524.
The text was updated successfully, but these errors were encountered: