DQL parsing on JSON

[ae]

I have this simple log:

Content

{

"HTTP_REQUEST_URL": ".....",

"HTTP_RESPONSE_CODE": 500,

"HTTP_RESPONSE_BODY": "errors",

"CURRENT_URL": "/example"

}

I'm trying to get all the http status count that are above 400 example below, but not sure how it works with JSON?
| parse content, "LD 'HTTP_RESPONSE_CODE ' INT:httpstatus"
| filter httpstatus >= 400
| summarize count(), by:{httpstatus}

[mark_bley · Accepted solution]

you can easily parse json (mocked some of the data):

data record(content="{\"HTTP_REQUEST_URL\": \".....\",\"HTTP_RESPONSE_CODE\": 500,\"HTTP_RESPONSE_BODY\": \"errors\",\"CURRENT_URL\": \"/example\"}"),
record(content="{\"HTTP_REQUEST_URL\": \".....\",\"HTTP_RESPONSE_CODE\": 500,\"HTTP_RESPONSE_BODY\": \"errors\",\"CURRENT_URL\": \"/example\"}"),
record(content="{\"HTTP_REQUEST_URL\": \".....\",\"HTTP_RESPONSE_CODE\": 501,\"HTTP_RESPONSE_BODY\": \"errors\",\"CURRENT_URL\": \"/example\"}")
| parse content, "JSON:http_payload"
| filter http_payload[HTTP_RESPONSE_CODE] >= 400
| summarize count(), by:{http_payload[HTTP_RESPONSE_CODE]}