In Vector, Split Datadog Tags from Single String to Dict

[tommyorndorff]

I'm working through Datadog Lambda Extension => Vector HTTP input. I'm almost there but I need to parse these ddtags. I could use some general help, if possible.

The raw data looks something like this (pared down and unnecessary fields removed):

{
   "message": "some message",
    "ddtags": "functionname:asdf-ddlambdaplaygroundfunction-itrzsnlh3s66,dd_extension_version:66"
}

The VRL to split the .ddtags into an array works fine with .ddtags_array, err = split(.ddtags, ","). But I'm not certain how to iterate over each field in the resulting array and split those to proper key/value pairs, then add those to a dict.

This is generally what I'm trying to do but errors:

.ddtags_dict = {}

for_each(.ddtags_array) -> |_index, value| {
  .keyvalue = split(value, ":")
  .ddtags_dict[.keyvalue[0]] = .keyvalue[1]
}

This is almost what I need but doesnt set the field dynamically:

# split single string to array
.ddtags_array, err = split(.ddtags, ",")

.ddtags_map = {}

for_each(.ddtags_array) -> |_index, value| {
  .keyvalue = split(value, ":")
  key = .keyvalue[0]
  value = .keyvalue[1]

  .ddtags_map.field = value
}

Any help is appreciated! VRL playground link included here.

[tommyorndorff]

Found it in the docs. Just need one function 🙏

.ddtags = parse_key_value!(.ddtags,key_value_delimiter: ":",field_delimiter: ",")