ParseKeyValue

Learn about the ParseKeyValue OTTL converter function.

  less than a minute  

The ParseKeyValue converter parses a key-value string into a map object.

Edge Delta Extension Available: EDXParseKeyValue significantly enhances this function with merge strategies for handling duplicate keys (first, last, append, concat, indexed) and automatic type conversion.

Syntax: ParseKeyValue(value, delimiter, pair-delimiter)

  • value: the location of the key-value string
  • delimiter (optional): the delimiter character for the key-value pairs. The default is a space but other characters will be attempted
  • pair-delimiter (optional): the delimiter character between the keys and their values. The default is =.

Input

{
	"_type": "log",
	"timestamp": 1735784094533,
	"body": "service=auth user=65532 action=login status=success location=us-east-1 service=billing action=invoice status=failure location=eu-west-2",
	"resource": {...},
	"attributes": {
		"decoded_body": "service=auth user=65532 action=login status=success location=us-east-1 service=billing action=invoice status=failure location=eu-west-2"
	}
}

Statement

set(attributes["kv_map"], ParseKeyValue(attributes["decoded_body"]))

Output

{
	"_type": "log",
	"timestamp": 1735784116721,
	"body": "service=auth user=65532 action=login status=success location=us-east-1 service=billing action=invoice status=failure location=eu-west-2",
	"resource": {...},
	"attributes": {
		"decoded_body": "service=auth user=65532 action=login status=success location=us-east-1 service=billing action=invoice status=failure location=eu-west-2",
		"kv_map": {
			"action": "invoice",
			"location": "eu-west-2",
			"service": "billing",
			"status": "failure",
			"user": "65532"
		}
	}
}

The decoded_body attribute is parsed into the kv_map. Note how the second values for duplicate fields, such as status, have over-written the first values. To deal with duplicate keys, see EDXParseKeyValue.