DQL Processing Rule with Brackets in JSON

[DanielS]

Hello Community,

I have this DQL Processing issue:

For this log

{
"event.type": "LOG",
"content": "{\"clientId\":\"35edd03e-84cd-4c7b-831d-e8318fbcfc06\",\"context\":\"ValidationService\",\"extras\":{\"errorCode\":\"PART_OF_DOCUMENT_MISSING\",\"retrievalData\":{\"capability\":\"usability\",\"data\":{},\"reason\":\"PART_OF_DOCUMENT_MISSING\",\"status\":\"REJECTED\"}},\"level\":\"info\",\"message\":\"Validation failed\",\"timestamp\":\"2024-06-11T14:00:05.649Z\",\"traceId\":\"97f9b7bd-a9ff-4c3d-8494-f28171e74bff\"}",
"status": "NONE",
"timestamp": "1718114405649"
}

 I have this processing rule:

PARSE(content, "
JSON{
  STRING:clientId,
  JSON {STRING:errorCode}:extras
}:parsedJson")
| FIELDS_ADD(top_level.attribute1: parsedJson["clientId"], top_level.attribute2: parsedJson["extras"]["errorCode"])
| FIELDS_REMOVE(parsedJson)

and my output is :

  "top_level.attribute1": "35edd03e-84cd-4c7b-831d-e8318fbcfc06",
  "top_level.attribute2": "PART_OF_DOCUMENT_MISSING",

Great, but this is only to probe that the rule is working, the original log has brackets in the nested extras:

{
"event.type": "LOG",
"content": "{\"clientId\":\"35edd03e-84cd-4c7b-831d-e8318fbcfc06\",\"context\":\"ValidationService\",\"extras\":[{\"errorCode\":\"PART_OF_DOCUMENT_MISSING\",\"retrievalData\":{\"capability\":\"usability\",\"data\":{},\"reason\":\"PART_OF_DOCUMENT_MISSING\",\"status\":\"REJECTED\"}}],\"level\":\"info\",\"message\":\"Validation failed\",\"timestamp\":\"2024-06-11T14:00:05.649Z\",\"traceId\":\"97f9b7bd-a9ff-4c3d-8494-f28171e74bff\"}",
"status": "NONE",
"timestamp": "1718114405649"
}

and with this brackets the parse won't work, how can I  modify the processing rule to retrieve the nested errorCode field?

Thanks

[mark_bley · Accepted solution]

That is a json array try this:

PARSE(content, "
JSON{
  STRING:clientId,
  JSON_ARRAY { JSON }:extras
}:parsedJson")
| FIELDS_ADD(top_level.attribute1: parsedJson["clientId"], top_level.attribute2: parsedJson["extras"][0]["errorCode"])
| FIELDS_REMOVE(parsedJson)

[DanielS]

Thanks @mark_bley !!!!!! Just to understand that [0] is the index of the attribute inside the array? if I need to recover something inside second level of nested retrievalData? I cannot found those examples in the doc.

[mark_bley]

1. Correct
2. Use either an index or key, depending on the type of object you access

You can find more detailed info regarding DPL here https://docs.dynatrace.com/docs/shortlink/dpl-json-arrays