DQL parsing on JSON

ae — Thu, 06 Jun 2024 08:18:17 GMT

I have this simple log:

Content

{

"HTTP_REQUEST_URL": ".....",

"HTTP_RESPONSE_CODE": 500,

"HTTP_RESPONSE_BODY": "errors",

"CURRENT_URL": "/example"

}

I'm trying to get all the http status count that are above 400 example below, but not sure how it works with JSON?
| parse content, "LD 'HTTP_RESPONSE_CODE ' INT:httpstatus"
| filter httpstatus >= 400
| summarize count(), by:{httpstatus}

Re: DQL parsing on JSON

mark_bley — Thu, 06 Jun 2024 10:57:24 GMT

you can easily parse json (mocked some of the data):

data record(content="{\"HTTP_REQUEST_URL\": \".....\",\"HTTP_RESPONSE_CODE\": 500,\"HTTP_RESPONSE_BODY\": \"errors\",\"CURRENT_URL\": \"/example\"}"), record(content="{\"HTTP_REQUEST_URL\": \".....\",\"HTTP_RESPONSE_CODE\": 500,\"HTTP_RESPONSE_BODY\": \"errors\",\"CURRENT_URL\": \"/example\"}"), record(content="{\"HTTP_REQUEST_URL\": \".....\",\"HTTP_RESPONSE_CODE\": 501,\"HTTP_RESPONSE_BODY\": \"errors\",\"CURRENT_URL\": \"/example\"}") | parse content, "JSON:http_payload" | filter http_payload[HTTP_RESPONSE_CODE] >= 400 | summarize count(), by:{http_payload[HTTP_RESPONSE_CODE]}

topic Re: DQL parsing on JSON in DQL

DQL parsing on JSON

Re: DQL parsing on JSON