kv

Parses a string into a map. It is possible to split based on different characters that represent either field or key value boundaries.

A good part of the logstash functionality will be handled ouYeside of this function and in a generic way in tremor script.

Predicate

When used with ~, the predicate passes if a string is valid that can be converted into a map.

Extractor

If the predicate passes, it converts the target into its equivalent map.

Features (in relation to Logstash):

Setting	Supported
allow_duplicate_values	No
default_keys	(via tremor script)
exclude_keys	(via tremor script)
field_split	Yes (default " " (space))
field_split_pattern	No
include_bracke	(via tremor script)
include_keys	(via tremor script)
prefix	(via tremor script)
recursive	No
remove_char_key	(via tremor script)
remove_char_value	(via tremor script)
source	(via tremor script)
target	(via tremor script)
tag_on_failure	(via tremor script)
tag_on_timeout	No
timeout_millis	No
transform_key	(via tremor script)
transform_value	(via tremor script)
trim_key	(via tremor script)
trim_value	(via tremor script)
value_split	Yes (default ":" (colon))
value_split_pattern	No
whitespace	(via tremor script)

To specify a value separator (the separator used between key and value) use the pattern form kv|%{key}=%{val}|. Both %{key} and %{val} are fixed keywords and can not be substituted for other names. The pattern kv|%{key}=%{val}| would lead to = being the separator. Multiple of those pairs can be given to use multiple separators.

To specify field separators they need to be either before or after a value separator or on their own. kv|&| would separate the fields by &.

Both field and value separators can be related without harm.

Field and value separators can not overlap, even partially.

Container patterns can be given by using multiple key value pairs with different separators, their order does not matter and they will not be required to be present.

Example

All of the following are equivalent:

match { "test" : "foo:bar snot:badger" } of
   case cake = %{ test ~= kv|| } => cake
   case cake = %{ test ~= kv| | } => cake
   case cake = %{ test ~= kv|| } => cake
   case cake = %{ test ~= kv|%{key}:%{val}|} => cake
   case cake = %{ test ~= kv|%{key}:%{val} |} => cake
   case cake = %{ test ~= kv| %{key}:%{val}|} => cake
   case cake = %{ test ~= kv|%{key}:%{val} %{key}:%{val} %{key}:%{val}|} => cake
   default => "ko"
end;

This will output:

"test": {
  "foo": "bar",
  "snot": "badger"
}

Example 2

Match query parameters

match event of
  case cake = %{test ~= kv|%{key}=%{val}&|} => cake
  default => "ko"
end;