ToKeyValueString
2 minute read
The ToKeyValueString converter converts a map into a string - the reverse of a parsing operation.
Syntax: ToKeyValueString(target, delimiter, pair_delimiter, sort_output)
- target: a field reference to the parent object of the map.
- delimiter: an optional string to separate each key from its value. The default is
=. - pair_delimiter: an optional string to separate the pairs from each other. The default is a space
. - sort_output: an optional Boolean that sorts the keys.
Input
[
{
"_type": "log",
"timestamp": 1735864826296,
"body": "session_id=abc123 user_id=admin event_type=login event_status=success debug_info=verbose connection_id=conn456 temp_file=report_tmp.log temp_data=sensitiveData",
"resource": {...},
"attributes": {
"decoded_body": "session_id=abc123 user_id=admin event_type=login event_status=success debug_info=verbose connection_id=conn456 temp_file=report_tmp.log temp_data=sensitiveData",
"kv_map": {
"connection_id": "conn456",
"event_status": "success",
"event_type": "login",
"session_id": "abc123",
"user_id": "admin"
}
}
}
]
In this example, the body has been decoded into decoded_body, parsed into kv_map, and had temp and debug values deleted. Next, a new string will be created using the kv_map:
Statement
set(attributes["new_body"], ToKeyValueString(attributes["kv_map"]))
Output
[
{
"_type": "log",
"timestamp": 1735864877366,
"body": "session_id=abc123 user_id=admin event_type=login event_status=success debug_info=verbose connection_id=conn456 temp_file=report_tmp.log temp_data=sensitiveData",
"resource": {},
"attributes": {
"decoded_body": "session_id=abc123 user_id=admin event_type=login event_status=success debug_info=verbose connection_id=conn456 temp_file=report_tmp.log temp_data=sensitiveData",
"kv_map": {
"connection_id": "conn456",
"event_status": "success",
"event_type": "login",
"session_id": "abc123",
"user_id": "admin"
},
"new_body": "session_id=abc123 user_id=admin event_type=login event_status=success connection_id=conn456"
}
}
]
A new_body attribute has been created from kv_map using the default space and = delimiters. Next, new_body could optionally be upserted into the body field after encoding it into a byte array using the Edge Delta EDXEncode custom function.