ParseKeyValue

This processor parses a specified field in the original log event into key-value pairs.

For more information about this processor including examples, see parseKeyValue in the CloudWatch Logs User Guide.

destination

The destination field to put the extracted key-value pairs into

Type: String

Length Constraints: Minimum length of 1. Maximum length of 128.

Required: No

fieldDelimiter

The field delimiter string that is used between key-value pairs in the original log events. If you omit this, the ampersand & character is used.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 128.

Required: No

keyPrefix

If you want to add a prefix to all transformed keys, specify it here.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 128.

Required: No

keyValueDelimiter

The delimiter string to use between the key and value in each pair in the transformed log event.

If you omit this, the equal = character is used.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 128.

Required: No

nonMatchValue

A value to insert into the value field in the result, when a key-value pair is not successfully split.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 128.

Required: No

overwriteIfExists

Specifies whether to overwrite the value if the destination key already exists. If you omit this, the default is false.

Type: Boolean

Required: No

source

Path to the field in the log event that will be parsed. Use dot notation to access child fields. For example, store.book

Type: String

Length Constraints: Minimum length of 1. Maximum length of 128.

Required: No

Contents