This message was deleted.
# generals
Slackbot
05/23/2023, 5:24 PMThis message was deleted.
o
Oleg Yamin
05/23/2023, 6:30 PMI think i found a way:
Copy code
"parser": {
"type": "string",
"parseSpec": {
"format": "tsv",
"timestampSpec": {
"column": "timestamp",
"format": "auto"
},
"transformSpec": {
"transforms": [
{
"type": "expression",
"name": "a",
"expression": "substring(params, index_of(params, '=') + 1, index_of(params, '&'))"
},
{
"type": "extraction",
"name": "c",
"expr": "substring(params, index_of(params, '=', index_of(params, '&')) + 1, index_of(params, '&', index_of(params, '&') + 1))"
}
]
}
"dimensionsSpec": {
"dimensions": [
"type",
"name",
"status",
"a",
"c"
]
},
"columns": [
"timestamp",
"type",
"name",
"status",
]
}
},v
Vadim
05/23/2023, 11:44 PMWhat a strange format to use both
\t&Vadim
05/23/2023, 11:45 PMI don't know how consistent the columns are but you could also use a regex
Vadim
05/23/2023, 11:47 PMyou could also try using tsv with delimiter set to
\t&a=bc=de=fVadim
05/23/2023, 11:48 PMwhich is not what you said you wanted but might work well depending on the usecase (I have seen real usecases where that was the ingestion method)
Vadim
05/23/2023, 11:52 PMit would look like this on the dataset you provided (which has one more column than you indicated)
o
Oleg Yamin
05/24/2023, 12:39 AMOh.. nice… I will have to give it a shot. Thank you very much for the suggestion. Yeah their messages are weird. Not sure who thought it was a good idea 😞