title: Nifi - Extracting Key Value pairs into new fields
body: <p>With Nifi I am trying to use the ReplaceText processor to extract key value pairs.
  The relevant part of the JSON file is the 'RuleName':</p>
  
  <pre><code>"winlog": {
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "event_id": 3,
      "api": "wineventlog",
      "process": {
        "pid": 1640,
        "thread": {
          "id": 4452
        }
      },
      "version": 5,
      "record_id": 521564887,
      "computer_name": "SERVER001",
      "event_data": {
        "RuleName": "Technique=Commonly Used Port,Tactic=Command and Control,MitreRef=1043"
      },
      "provider_guid": "{5790385F-C22A-43E0-BF4C-06F5698FFBD9}",
      "opcode": "Info",
      "provider_name": "Microsoft-Windows-Sysmon",
      "task": "Network connection detected (rule: NetworkConnect)",
      "user": {
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "domain": "NT AUTHORITY",
        "type": "Well Known Group"
      }
    },
  </code></pre>
  
  <p>Within the ReplaceText processor I have this configuration
  <a href="https://i.stack.imgur.com/EwqPq.png" rel="nofollow noreferrer">ReplaceText</a></p>
  
  <pre><code>"winlog.event_data.RuleName":"MitreRef=(.*),Technique=(.*),Tactic=(.*),Alert=(.*)"
  "MitreRef":"$1","Technique":"$2","Tactic":"$3","Alert":"$4"
  </code></pre>
  
  <p>The first problem is that the new fields MitreRef etc. are not created.
  The second thing is that the fields may appear in any order in the original JSON, e.g.
  <code>"RuleName": "Technique=Commonly Used Port,Tactic=Command and Control,MitreRef=1043"</code>
  or,
  <code>MitreRef=1043,Tactic=Command and Control,Technique=Commonly Used Port</code></p>
  
  <p>Any ideas on how to proceed?</p>