parse-keyvals

Parse key=value pairs from event.payload (raw bytes from a source plugin) or event.message. payload takes priority when both are present.

Recognized keys are promoted to top-level fields:

All other keys are collected into event.labels. The source field (payload or message) is removed from the output.

Severity mapping

Config

Optional:

• delim (string, single character): Key/value delimiter (default: =)

Behaviour notes

• Quoted values (single or double) are supported: msg="hello world"
• Escaped double quotes inside double-quoted values are supported: msg="say \"hi\""
• Whitespace around the delimiter is allowed: level = warn
• Parsed msg or message will overwrite any existing top-level message field
• Parsed level will overwrite any existing severity field

Example

pipeline:
  parse-lines:
  parse-keyvals:

Input event (from parse-lines):

{ "message": "level=warn msg=\"disk full\" host=web01" }

Output event:

{ "severity": 4, "message": "disk full", "labels": { "host": "web01" } }