Trying to extract the field "txnRef" from the below sample log. I am able to extract "txnRef", when I just test the sample log start from "TIMESTAMP"(from second line), but the actual log starts with "event" (from the first line in below sample log) and it didn't pick it up when I tried to extract using complete log.
Below is the complete sample log:
"{\"event\":[{\"TIMESTAMP\":\"1720629413\",\"CINAME\":\"requestResendEventAuthorization3.0\",\"OPERATION\":\"fs_incoming_json(ACME_MSG)\",\"txnRef\":\"56c608d6-f2ce-43ff-d5b4-b0a758528658\",\"status\":\"success\",\"provider\":\"EI\",\"elapsedTime\":\"155\",\"originator\":\"DTVMW-DTV360Biz\",\"bpn\":\"DTVMW_MulesoftINT_RequestResendEventAuthorization\",\"hostName\":\"cplvfopwb001\",\"participatingSystem\":\"EI-ACME-OCA\",\"providerElapsedTime\":\"0\",\"timestamp\":\"2024-07-10T16:36:52.918Z\"}]}"
}
Matcher:
matchesPhrase(content, "txnRef") and matchesPhrase(content, "originator")
Process Definition:
PARSE(content, "JSON{ STRING:'txnRef'}:parsed")
|FIELDS_ADD("txnRef": parsed["txnRef"])
|FIELDS_REMOVE(parsed)
Can someone Please look into this and help me on this.
Thanks in Advance,
-Venkat
