topic Parse JSON log content in DQL

Parse JSON log content

Malachi157 — Fri, 16 May 2025 12:21:16 GMT

Hello, I am trying to parse the scanActionCode and actionStation fields out of the content field in the logs. Here's a sample log. Please can someone help me with the dql to parse these fields out of the logs? Any help for be greatly appreciated!

2025-04-02T12:04:59.884Z INFO 1 --- [smartscan1732] [nio-8080-exec-3] s.l.RampGatewayLoggingRequestInterceptor : request to url : https://baggage-services.prd.adh.aws.ual.com/api/queryScan , body : {"bagReq":{"hdr":{"userID":"U392262","scannerInformation":{"scannerMACAddress":"02:00:00:00:00:00","scannerID":"392262","scannerSerialNumber":"22143B3AF4","version":"ZEBRA TC70_1.0.1740","dutyCode":null,"scannerIP":null},"localUploadTimeStamp":"2025-04-02T07:04:58","scanActionCode":"RFLF","actionStation":"ORD"},"flightInfo":null,"bagReqInfo":{"flightInfo":{"flightNumber":"0354","flightStatus":null,"carrierCode":"UA","departureStation":null,"arrivalStation":"ORD","gate":null,"arrivalGate":null,"departureGate":null,"noseNumber":null,"tailNumber":null,"localEstimateArrivalDate":null,"localScheduledArrivalDate":null,"equipmentCode":null,"localEstimatedDepartureDate":null,"localScheduledDepartureDate":null,"carrierType":null,"arrivalBagClaimUnitedID":null,"equipmentDescription":null,"isWideBody":null,"isInternational":null,"departureReasonCode":null,"arrivalReasonCode":null,"departureDate":"2025-04-01","fltLclOrigDt":null,"opsLegSequenceNumber":null,"seg":null,"acftNumber":null,"departureBagSectorNumber":null,"arrivalBagScreenAlert":null,"isFlightDepartureDiverted":null}}}}

Re: Parse JSON log content

mark_bley — Sat, 05 Apr 2025 01:04:02 GMT

how about this one:

data record(data="""2025-04-02T12:04:59.884Z INFO 1 --- [smartscan1732] [nio-8080-exec-3] s.l.RampGatewayLoggingRequestInterceptor : request to url : https://baggage-services.prd.adh.aws.ual.com/api/queryScan , body : {"bagReq":{"hdr":{"userID":"U392262","scannerInformation":{"scannerMACAddress":"02:00:00:00:00:00","scannerID":"392262","scannerSerialNumber":"22143B3AF4","version":"ZEBRA TC70_1.0.1740","dutyCode":null,"scannerIP":null},"localUploadTimeStamp":"2025-04-02T07:04:58","scanActionCode":"RFLF","actionStation":"ORD"},"flightInfo":null,"bagReqInfo":{"flightInfo":{"flightNumber":"0354","flightStatus":null,"carrierCode":"UA","departureStation":null,"arrivalStation":"ORD","gate":null,"arrivalGate":null,"departureGate":null,"noseNumber":null,"tailNumber":null,"localEstimateArrivalDate":null,"localScheduledArrivalDate":null,"equipmentCode":null,"localEstimatedDepartureDate":null,"localScheduledDepartureDate":null,"carrierType":null,"arrivalBagClaimUnitedID":null,"equipmentDescription":null,"isWideBody":null,"isInternational":null,"departureReasonCode":null,"arrivalReasonCode":null,"departureDate":"2025-04-01","fltLclOrigDt":null,"opsLegSequenceNumber":null,"seg":null,"acftNumber":null,"departureBagSectorNumber":null,"arrivalBagScreenAlert":null,"isFlightDepartureDiverted":null}}}}""") | parse data, "LD 'body : ' JSON:json" | fieldsAdd scanActionCode = json[bagReq][hdr][scanActionCode] | fieldsAdd actionStation = json[bagReq][hdr][actionStation]

Hope it helps.