Rules (XQL)
[INGEST:vendor="atlassian", product="confluence", target_dataset="atlassian_confluence_raw", no_hit = keep]
filter to_string(changedvalues) ~= "^\[[\s\S]+\]$"
| alter
tmp_changed_values_name = arraymap(to_string(changedvalues) -> [], replex("@element" -> name, "\s+|\/", "_")),
tmp_values_old = arraystring(arraymap(to_string(changedvalues) -> [], "@element" -> oldValue), "|"),
tmp_values_new = arraystring(arraymap(to_string(changedvalues) -> [], "@element" -> newValue), "|")
| alter
tmp_obj_struct = arraystring(arraymap(tmp_changed_values_name, concat("(?P<", "@element", ">[^\|]+)")), "\|")
| alter
parsed_fields_changed_values_old = regexcapture(tmp_values_old, tmp_obj_struct),
parsed_fields_changed_values_new = regexcapture(tmp_values_new, tmp_obj_struct)
| fields -tmp*;