Skip to main content
Sumo Logic

3.2 You want to automatically extract key, value pairs

Problem

Your log messages consist of key-value pairs (label1=data, label2=data, and so on) and you may need access to any key's value.

Solution

Use the keyvalue operator in automatic mode, like this:

* | keyvalue auto

Discussion

The keyvalue operator has many advanced options, but the auto mode simply extracts everything that looks like a key-value pair from your log messages. This allows you to refer to the value of a particular key, or (using the fields operator) to create a display column for each key and convert your log messages into a spreadsheet format.