Log Processing : Is it possible to use a logattribute to referece a PARSED JSON object value

[pallepavan]

Hi All,

I am trying to enrich log based on a Fixed JSON dataset and incoming log attribute, I have parsed the Fixed json object and trying to add a new field value from Json while existing log attribute as key. is this possible to do this ?

Ex: Fixed JSON dataset 
{ "get_key_1": "value1", 

"get_key_2" : "value2" .... )

Expecting log has check_key="get_key_1"
i want to reference value1 based on check_key , something like parsedJSON[ ${check_key} ] . Is it possible to do this ?

[Tomasz_Wozniak]

I'm not sure I understand what the problem is.

It looks to like a very common uses case to me. Have you seen this docuemntation example for the classic log processing or the equivalent for OpenPipeline?

It should be as ease as

PARSE(content,"JSON:parsedJson")
| FIELDS_ADD(f1: parsedJson["intField"]
| FIELDS_REMOVE(parsedJson)