cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

JSON parsing: fieldsAdd or

ghfsa
Visitor

I have a DQL which filters down to one of two possible JSONs:

 

content = {"code":"an_error_code","error":{"code":"an_error_code","message":"An error message appears here..."}

 

 or

 

content = {"level":"error","message":"Some error here..."}

 

 

The output I want is: timestamp + error code (or empty string) + error message. So far, I have:

 

 

fetch logs
| filter k8s.namespace.name == "default"
| filter contains(content, "error")
| parse content, "JSON:parsedJSON"
| fieldsAdd error_code = parsedJSON[error][code], error_message = (parsedJSON[message] or parsedJSON[error][message])

 

3 REPLIES 3

FranciscoGarcia
Dynatrace Advisor
Dynatrace Advisor

This should do it

 

data record(timestamp=now(), content = """{"code":"an_error_code","error":{"code":"an_error_code","message":"An error message appears here..."}}"""),
     record(timestamp=now(), content = """{"level":"error","message":"Some error here..."}""")

| parse content, "JSON:parsedJSON"
| fieldsAdd error_code = parsedJSON[error][code], error_message = if (isNull(parsedJSON[message]), parsedJSON[error][message], else:parsedJSON[message])
| fieldsAdd output=concat(toString(timestamp),"--- ",error_code, " ",error_message )
| fields output

 

FranciscoGarcia
Dynatrace Advisor
Dynatrace Advisor

FranciscoGarcia_0-1715331108149.png

 

krzysztof_hoja
Dynatrace Advisor
Dynatrace Advisor

Simpler way to express:

error_message = if (isNull(parsedJSON[message]), parsedJSON[error][message], else:parsedJSON[message])

is using coalesce function

error_message =coalesce(parsedJSON[message], parsedJSON[error][message])

 

Kris

Featured Posts