topic Need hep in pulling nested json log line as seprate line with DPL in DQL

Need hep in pulling nested json log line as seprate line with DPL

Dest-Roh — Fri, 03 Apr 2026 09:26:51 GMT

Hi Team i need an help in converting below nested json to multiple lines in log processing rule with DPL syntax but unfortunately i am unable to pull all record.

Additinalinfo:
DATA DETAILS:
{ "Report":[{"SessionID":300,"BlockingSessionID":821,"BlockedSessionCount":0,"Status":"suspended","OpenTranCount":0,"HostName":"xyx","DBName":"xyz","StartTime":"2026-04-01T13:24:23.003"},
{"SessionID":300,"BlockingSessionID":821,"BlockedSessionCount":0,"Status":"suspended","OpenTranCount":0,"HostName":"mmy","DBName":"abc","StartTime":"2026-04-01T13:24:23.003"},
{"SessionID":300,"BlockingSessionID":821,"BlockedSessionCount":0,"Status":"suspended","OpenTranCount":0,"HostName":"wwe","DBName":"tzt","StartTime":"2026-04-01T13:24:23.003"}]}

the numbers of record may increase so DPL should be dynamic to keep that new nested lines as new record from json

Re: Need hep in pulling nested json log line as seprate line with DPL

MaximilianoML — Thu, 02 Apr 2026 08:35:17 GMT

Hello @Dest-Roh

Let's me try to help you in this one,

I'm not sure if I understood correctly but what you want here it'll only map to a single Dynatrace log record, and looking into the data you put you have more than one log in the record. Anyway, the DPL should be something like this bellow:

(BOF '[')? JSON_OBJECT{ LONG+:SessionID, LONG:BlockingSessionID, LONG:BlockedSessionCount, STRING:Status, LONG:OpenTranCount, STRING:HostName, STRING:DBName, TIMESTAMP("yyyy-MM-dd'T'HH:mm:ss.SSS"):StartTime }:record ','? (']' EOF)?

I would say that the best approach is to split the payload before ingestion, so each Report item is sent as its own log record. This subject isn't my strongest point, maybe someone else could add more info here.

Re: Need hep in pulling nested json log line as seprate line with DPL

Dest-Roh — Thu, 02 Apr 2026 10:43:23 GMT

This logic is able to pull the first record only but other record separated by comma its not picking UP {[{record1},{record2},{record3}]}

Need to seperate as

{Record1}

{Record2}

{Record3}

Re: Need hep in pulling nested json log line as seprate line with DPL

MaximilianoML — Thu, 02 Apr 2026 10:59:49 GMT

Humm.... Okay.

Maybe this one, now ChatGPT is helping me:

(BOF '{' SPACE? '"Report"' SPACE? ':' SPACE? '[')? JSON_OBJECT{ LONG+:SessionID, LONG:BlockingSessionID, LONG:BlockedSessionCount, STRING:Status, LONG:OpenTranCount, STRING:HostName, STRING:DBName, TIMESTAMP("yyyy-MM-dd'T'HH:mm:ss.SSS"):StartTime }:record ','? (']' SPACE? '}' EOF)?

Re: Need hep in pulling nested json log line as seprate line with DPL

krzysztof_hoja — Fri, 03 Apr 2026 05:53:46 GMT

Unfortunalty it is not possible to do just with DPL. You need expand from DQL to do this transformation:

data record(content="""{ "Report":[{"SessionID":300,"BlockingSessionID":821,"BlockedSessionCount":0,"Status":"suspended","OpenTranCount":0,"HostName":"xyx","DBName":"xyz","StartTime":"2026-04-01T13:24:23.003"}, {"SessionID":300,"BlockingSessionID":821,"BlockedSessionCount":0,"Status":"suspended","OpenTranCount":0,"HostName":"mmy","DBName":"abc","StartTime":"2026-04-01T13:24:23.003"}, {"SessionID":300,"BlockingSessionID":821,"BlockedSessionCount":0,"Status":"suspended","OpenTranCount":0,"HostName":"wwe","DBName":"tzt","StartTime":"2026-04-01T13:24:23.003"}]} """) | parse content, """JSON:record""" | expand record=record[Report] | fields record