topic Re: Log Processing : Is it possible to use a logattribute to referece a PARSED JSON object value in DQL

Log Processing : Is it possible to use a logattribute to referece a PARSED JSON object value

pallepavan — Wed, 02 Oct 2024 12:42:32 GMT

Hi All,

I am trying to enrich log based on a Fixed JSON dataset and incoming log attribute, I have parsed the Fixed json object and trying to add a new field value from Json while existing log attribute as key. is this possible to do this ?

Ex: Fixed JSON dataset
{ "get_key_1": "value1",

"get_key_2" : "value2" .... )

Expecting log has check_key="get_key_1"
i want to reference value1 based on check_key , something like parsedJSON[ ${check_key} ] . Is it possible to do this ?

Re: Log Processing : Is it possible to use a logattribute to referece a PARSED JSON object value

Tomasz_Wozniak — Thu, 28 Nov 2024 11:09:03 GMT

I'm not sure I understand what the problem is.

It looks to like a very common uses case to me. Have you seen this docuemntation example for the classic log processing or the equivalent for OpenPipeline?

It should be as ease as

PARSE(content,"JSON:parsedJson") | FIELDS_ADD(f1: parsedJson["intField"] | FIELDS_REMOVE(parsedJson)