topic Re: DQL Processing Rule with Brackets in JSON in DQL

DQL Processing Rule with Brackets in JSON

DanielS — Tue, 11 Jun 2024 16:24:36 GMT

Hello Community,

I have this DQL Processing issue:

For this log

{ "event.type": "LOG", "content": "{\"clientId\":\"35edd03e-84cd-4c7b-831d-e8318fbcfc06\",\"context\":\"ValidationService\",\"extras\":{\"errorCode\":\"PART_OF_DOCUMENT_MISSING\",\"retrievalData\":{\"capability\":\"usability\",\"data\":{},\"reason\":\"PART_OF_DOCUMENT_MISSING\",\"status\":\"REJECTED\"}},\"level\":\"info\",\"message\":\"Validation failed\",\"timestamp\":\"2024-06-11T14:00:05.649Z\",\"traceId\":\"97f9b7bd-a9ff-4c3d-8494-f28171e74bff\"}", "status": "NONE", "timestamp": "1718114405649" }

I have this processing rule:

PARSE(content, " JSON{ STRING:clientId, JSON {STRING:errorCode}:extras }:parsedJson") | FIELDS_ADD(top_level.attribute1: parsedJson["clientId"], top_level.attribute2: parsedJson["extras"]["errorCode"]) | FIELDS_REMOVE(parsedJson)

and my output is :

"top_level.attribute1": "35edd03e-84cd-4c7b-831d-e8318fbcfc06", "top_level.attribute2": "PART_OF_DOCUMENT_MISSING",

Great, but this is only to probe that the rule is working, the original log has brackets in the nested extras:

{ "event.type": "LOG", "content": "{\"clientId\":\"35edd03e-84cd-4c7b-831d-e8318fbcfc06\",\"context\":\"ValidationService\",\"extras\":[{\"errorCode\":\"PART_OF_DOCUMENT_MISSING\",\"retrievalData\":{\"capability\":\"usability\",\"data\":{},\"reason\":\"PART_OF_DOCUMENT_MISSING\",\"status\":\"REJECTED\"}}],\"level\":\"info\",\"message\":\"Validation failed\",\"timestamp\":\"2024-06-11T14:00:05.649Z\",\"traceId\":\"97f9b7bd-a9ff-4c3d-8494-f28171e74bff\"}", "status": "NONE", "timestamp": "1718114405649" }

and with this brackets the parse won't work, how can I modify the processing rule to retrieve the nested errorCode field?

Thanks

Re: DQL Processing Rule with Brackets in JSON

mark_bley — Tue, 11 Jun 2024 19:12:55 GMT

That is a json array try this:

PARSE(content, " JSON{ STRING:clientId, JSON_ARRAY { JSON }:extras }:parsedJson") | FIELDS_ADD(top_level.attribute1: parsedJson["clientId"], top_level.attribute2: parsedJson["extras"][0]["errorCode"]) | FIELDS_REMOVE(parsedJson)

Re: DQL Processing Rule with Brackets in JSON

DanielS — Tue, 11 Jun 2024 19:54:58 GMT

Thanks @mark_bley !!!!!! Just to understand that [0] is the index of the attribute inside the array? if I need to recover something inside second level of nested retrievalData? I cannot found those examples in the doc.

Re: DQL Processing Rule with Brackets in JSON

mark_bley — Wed, 12 Jun 2024 07:11:45 GMT

Correct
Use either an index or key, depending on the type of object you access

You can find more detailed info regarding DPL here https://docs.dynatrace.com/docs/shortlink/dpl-json-arrays