Skip to main content
Version: Next

KV

Parses a string into a map. It is possible to split based on different characters that represent either field or key value boundaries.

A good part of the logstash functionality will be handled ouYeside of this function and in a generic way in tremor script.

Predicate

When used with ~, the predicate passes if a string is valid that can be converted into a map.

Extractor

If the predicate passes, it converts the target into its equivalent map.

Features (in relation to Logstash):

SettingSupported
allow_duplicate_valuesNo
default_keys(via tremor script)
exclude_keys(via tremor script)
field_splitYes (default " " (space))
field_split_patternNo
include_bracke(via tremor script)
include_keys(via tremor script)
prefix(via tremor script)
recursiveNo
remove_char_key(via tremor script)
remove_char_value(via tremor script)
source(via tremor script)
target(via tremor script)
tag_on_failure(via tremor script)
tag_on_timeoutNo
timeout_millisNo
transform_key(via tremor script)
transform_value(via tremor script)
trim_key(via tremor script)
trim_value(via tremor script)
value_splitYes (default ":" (colon))
value_split_patternNo
whitespace(via tremor script)

To specify a value separator (the separator used between key and value) use the pattern form kv|%{key}=%{val}|. Both %{key} and %{val} are fixed keywords and can not be substituted for other names. The pattern kv|%{key}=%{val}| would lead to = being the separator. Multiple of those pairs can be given to use multiple separators.

To specify field separators they need to be either before or after a value separator or on their own. kv|&| would separate the fields by &.

Both field and value separators can be related without harm.

Field and value separators can not overlap, even partially.

Complex patterns can be given by using multiple key value pairs with different separators, their order does not matter and they will not be required to be present.

Example

All of the following are equivalent:

match { "test" : "foo:bar snot:badger" } of
case cake = %{ test ~= kv|| } => cake
case cake = %{ test ~= kv| | } => cake
case cake = %{ test ~= kv|| } => cake
case cake = %{ test ~= kv|%{key}:%{val}|} => cake
case cake = %{ test ~= kv|%{key}:%{val} |} => cake
case cake = %{ test ~= kv| %{key}:%{val}|} => cake
case cake = %{ test ~= kv|%{key}:%{val} %{key}:%{val} %{key}:%{val}|} => cake
default => "ko"
end;

This will output:

"test": {
"foo": "bar",
"snot": "badger"
}

Example 2

Match query parameters

match event of
case cake = %{test ~= kv|%{key}=%{val}&|} => cake
default => "ko"
end;