cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Is there a reverse command of fieldsFlatten?

lucassilveira
Newcomer

I would like to make a json from some log attributes. Is this possible?

5 REPLIES 5

krzysztof_hoja
Dynatrace Champion
Dynatrace Champion

Yes, if you can enumerate them. Let's assume you have following demo data:

krzysztof_hoja_0-1729526955878.png

You can build object (complex record) using record function:

krzysztof_hoja_1-1729527017011.png

Here is my query for easy reuse:

data json:"""[{"a":1,"b":"x"},{"a":2,"b":"y"}]"""
| fieldsAdd j = record(a,b)
| fieldsAdd js = toString(j)

I hope it helps

 

Perfect, thank you!

Hello @lucassilveira , 

can you mention sample log line to give you the proper transformation method?

Certified Dynatrace Professional | Certified Dynatrace Services - Observability | Dynatrace Partner yourcompass.ca

Mohamed_Hamdy
DynaMight Champion
DynaMight Champion

In addition to what @krzysztof_hoja mentioned, you can use Key-Value Pairs (KVPs) as outlined in the documentation: Key-Value Pairs.

In a log processing rule, you can use the KVP operator to transform the necessary key-value pairs into JSON.

For example:

PARSE(content,"'[' JSONTIMESTAMP:timestamp '] ' KVP{'['[^[:]*:key ': ' DATA:value '] '}:kvp '[[' DATA:message ']]'")
|FIELDS_ADD(loglevel:kvp[LOGLEVEL])

Certified Dynatrace Professional | Certified Dynatrace Services Delivery - Observability & CloudOps | Dynatrace Partner - yourcompass.ca

Nice. I didn't know this feature.

Featured Posts