We have a mixed dataset, separated by pipes (see #524 ). Most of it is Key Value pairs, however some of them are just single words. It would be nice, if the Key Value parser would assign generic field names based on position within the array based on the delimiter.
<30>Jan 10 21:23:41 mahcaproxy1 mwg: LEEF:1.0|McAfee|Web Gateway|9.2.16|0|devTime=1641849821000|usrName=caapm|realm=mahedeamdmz-vip.ups.com|src=10.220.2.12|srcPort=20331
From the example snippet above, the output I would like to see would be this mix of generic field names and named fields:
field0: <30>Jan 10 21:23:41 mahcaproxy1 mwg: LEEF:1.0
field1: McAffee
field2: Web Gateway
field3: 9.2.16
field4: 0
devTime: 1641849821000
usrName: caapm
realm: mahedeamdmz-vip.ups.com
src: 10.220.2.12
srcPort: 20331
Currently using regex parsing due to this and #524.
We have a mixed dataset, separated by pipes (see #524 ). Most of it is Key Value pairs, however some of them are just single words. It would be nice, if the Key Value parser would assign generic field names based on position within the array based on the delimiter.
<30>Jan 10 21:23:41 mahcaproxy1 mwg: LEEF:1.0|McAfee|Web Gateway|9.2.16|0|devTime=1641849821000|usrName=caapm|realm=mahedeamdmz-vip.ups.com|src=10.220.2.12|srcPort=20331From the example snippet above, the output I would like to see would be this mix of generic field names and named fields:
field0: <30>Jan 10 21:23:41 mahcaproxy1 mwg: LEEF:1.0
field1: McAffee
field2: Web Gateway
field3: 9.2.16
field4: 0
devTime: 1641849821000
usrName: caapm
realm: mahedeamdmz-vip.ups.com
src: 10.220.2.12
srcPort: 20331
Currently using regex parsing due to this and #524.