cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

DQL Processing Rule with Brackets in JSON

DanielS
DynaMight Guru
DynaMight Guru

Hello Community,

I have this DQL Processing issue:

For this log

{
"event.type": "LOG",
"content": "{\"clientId\":\"35edd03e-84cd-4c7b-831d-e8318fbcfc06\",\"context\":\"ValidationService\",\"extras\":{\"errorCode\":\"PART_OF_DOCUMENT_MISSING\",\"retrievalData\":{\"capability\":\"usability\",\"data\":{},\"reason\":\"PART_OF_DOCUMENT_MISSING\",\"status\":\"REJECTED\"}},\"level\":\"info\",\"message\":\"Validation failed\",\"timestamp\":\"2024-06-11T14:00:05.649Z\",\"traceId\":\"97f9b7bd-a9ff-4c3d-8494-f28171e74bff\"}",
"status": "NONE",
"timestamp": "1718114405649"
}

 I have this processing rule:

PARSE(content, "
JSON{
  STRING:clientId,
  JSON {STRING:errorCode}:extras
}:parsedJson")
| FIELDS_ADD(top_level.attribute1: parsedJson["clientId"], top_level.attribute2: parsedJson["extras"]["errorCode"])
| FIELDS_REMOVE(parsedJson)

and my output is :

  "top_level.attribute1": "35edd03e-84cd-4c7b-831d-e8318fbcfc06",
  "top_level.attribute2": "PART_OF_DOCUMENT_MISSING",

 

Great, but this is only to probe that the rule is working, the original log has brackets in the nested extras:

{
"event.type": "LOG",
"content": "{\"clientId\":\"35edd03e-84cd-4c7b-831d-e8318fbcfc06\",\"context\":\"ValidationService\",\"extras\":[{\"errorCode\":\"PART_OF_DOCUMENT_MISSING\",\"retrievalData\":{\"capability\":\"usability\",\"data\":{},\"reason\":\"PART_OF_DOCUMENT_MISSING\",\"status\":\"REJECTED\"}}],\"level\":\"info\",\"message\":\"Validation failed\",\"timestamp\":\"2024-06-11T14:00:05.649Z\",\"traceId\":\"97f9b7bd-a9ff-4c3d-8494-f28171e74bff\"}",
"status": "NONE",
"timestamp": "1718114405649"
}

and with this brackets the parse won't work, how can I  modify the processing rule to retrieve the nested errorCode field?

Thanks

The true delight is in the finding out rather than in the knowing.
3 REPLIES 3

mark_bley
Dynatrace Champion
Dynatrace Champion

That is a json array try this:

PARSE(content, "
JSON{
  STRING:clientId,
  JSON_ARRAY { JSON }:extras
}:parsedJson")
| FIELDS_ADD(top_level.attribute1: parsedJson["clientId"], top_level.attribute2: parsedJson["extras"][0]["errorCode"])
| FIELDS_REMOVE(parsedJson)

Thanks @mark_bley !!!!!! Just to understand that [0] is the index of the attribute inside the array? if I need to recover something inside second level of nested retrievalData? I cannot found those examples in the doc.

The true delight is in the finding out rather than in the knowing.

mark_bley
Dynatrace Champion
Dynatrace Champion
  1. Correct
  2. Use either an index or key, depending on the type of object you access

You can find more detailed info regarding DPL here https://docs.dynatrace.com/docs/shortlink/dpl-json-arrays

 

Featured Posts