<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Based on the following structured syslog, I am trying to extract the reason from the SDATA portion of the log.<div><br><div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Helvetica; ">2012-02-05T16:24:45.368 RT_FLOW - RT_FLOW_SESSION_CLOSE [<a href="mailto:junos@2636.1.1.1.2.36">junos@2636.1.1.1.2.36</a> reason=\”unset\” ]</div></div><div><br></div><div>Problem I think I am running into is the value-pair that I am trying to extract includes the dots so the parser thinks its nested information</div></div><div><br></div><div><div>destination d_mongodb {</div><div> mongodb(</div><div> value-pairs(</div><div><span class="Apple-tab-span" style="white-space: pre; "> scope("everything")</span></div><div> key(".SDATA.junos@2636.1.1.1.2.36.reason")</div><div> )</div><div> );</div><div>};</div></div><div><br></div><div><br></div><div>Thoughts? Any help is greatly appreciated.</div><div><br></div><div>Chris</div></body></html>