Extracting details from JSON message.

Follow

Future Advisor

• June 14, 2016 16:23

I have something like this: { "message":"2016-06-13T22:37:37.495559000+00:00 INFO 0.0.0.0 User Logged In Successfully distribution=corp location=nil user_id=123", "meta_hostname":"myhost.hostname.com", "meta_timestamp":"2016-06-13 22:37:37 +0000", "meta_source":"app-logs", "meta_application":"blah" } How do I extract the IP address (assuming regex) along with the user_id in a search? I just need those two fields. Thanks.

0

• 

  Kelly Hamm

  • June 15, 2016 23:27

  Hi Will- how about this? | parse regex "(?\d+\.\d+\.\d+\.\d)\s", "user_id=*\"" as user

  0

  Comment actions Permalink

Please sign in to leave a comment.