SIEM search query on key:value

Hello, when searching for an event, how can I join the value of the key and its value? For example, I have the next two events, but I'd like to search only those that are res_kind = Deployment 

Event 1:

...

about[0].labels[1].key: "res_kind"

about[0].labels[1].value: "Deployment"

about[0].labels[2].key: "operation_first"

about[0].labels[2].value: "true"

...

 

Event2:

...

about[0].labels[1].key: "res_kind"

about[0].labels[1].value: "Service"

about[0].labels[2].key: "operation_first"

about[0].labels[2].value: "true"

...

 

When running with the same value, it does not work: 

keso_0-1732705926338.png

It should be generic, so it would be something like:

about.labels.key = "res_kind" and about.labels.value = "Deployment"
but then any of the about.labels.value would have "Deployment" and not the one with the res_kind in the key
 
 
Thank you!

 

1 3 356
3 REPLIES 3