topic JSON parsing: fieldsAdd or in DQL

JSON parsing: fieldsAdd or

ghfsa — Mon, 29 Apr 2024 05:28:21 GMT

I have a DQL which filters down to one of two possible JSONs:

content = {"code":"an_error_code","error":{"code":"an_error_code","message":"An error message appears here..."}

content = {"level":"error","message":"Some error here..."}

The output I want is: timestamp + error code (or empty string) + error message. So far, I have:

fetch logs | filter k8s.namespace.name == "default" | filter contains(content, "error") | parse content, "JSON:parsedJSON" | fieldsAdd error_code = parsedJSON[error][code], error_message = (parsedJSON[message] or parsedJSON[error][message])

Re: JSON parsing: fieldsAdd or

FranciscoGarcia — Fri, 10 May 2024 08:58:33 GMT

This should do it

data record(timestamp=now(), content = """{"code":"an_error_code","error":{"code":"an_error_code","message":"An error message appears here..."}}"""), record(timestamp=now(), content = """{"level":"error","message":"Some error here..."}""") | parse content, "JSON:parsedJSON" | fieldsAdd error_code = parsedJSON[error][code], error_message = if (isNull(parsedJSON[message]), parsedJSON[error][message], else:parsedJSON[message]) | fieldsAdd output=concat(toString(timestamp),"--- ",error_code, " ",error_message ) | fields output

Re: JSON parsing: fieldsAdd or

FranciscoGarcia — Fri, 10 May 2024 08:52:22 GMT

Re: JSON parsing: fieldsAdd or

krzysztof_hoja — Fri, 10 May 2024 12:06:00 GMT

Simpler way to express:

error_message = if (isNull(parsedJSON[message]), parsedJSON[error][message], else:parsedJSON[message])

is using coalesce function

error_message =coalesce(parsedJSON[message], parsedJSON[error][message])

Kris