Is there a way to extract the key-value pair in the JSON object from the _raw field in the Pipeline?

Can you share a Screenshot of how your sample actually looks in Cribl preview?

it's a script that returns a dictionary:

Does that JSON file LINT properly?

The JSON standard requires double quotes and will not accept single quotes, nor will the parser.

Your raw has single quotes.

Thats likely a python dict, not JSON

0

`'(?<_KEY_0>.+?)':'(?<_VALUE_0>.+?)'`

Just use the REGEX Function

<@U041MGED76H&gt; Does that make sense?

Thanks, both! Well spotted and quick solution! I'll give that a go! :pray:

If you can modify that script, it's effectively just wrapping the output in json.dumps().

Clearly the better long term solution ^^