Graylog2 / Graylog2/graylog2-server
Add support to the key_value parser to extract values from duplicated keys as a list.
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## What?
Update the `key_value()` parser to support providing values from duplicated keys as a list.
The `key_value()` function currently users a parameter `handle_dup_keys` that enables using the first value extracted (`take_first`), the last value extracted (`take_last`), or providing a character that is used as a delimiter for concatenating all of the extracted values.
## Why?
This will allow searching and aggregating data based on the extracted key values more functional and accurate due to having the values from duplicate keys in a message extracted as individual values instead of concatenated.
In Illuminate we currently have to define additional pipeline rules to process these fields and split the values from concatenated strings into separate values in at least two separate packs, having the function provide extracted results in this format will be a much more elegant solution and eliminate the complexity required in pipeline rules to achieve this outcome.
## Your Environment
* Graylog Version:
* OpenSearch Version:
* MongoDB Version:
* Operating System:
* Browser version:
Contributor guide
Assessment
This issue has not been assessed yet.