Log Processing Rule - classic

[JhonU]

Hello everyone, I'm new to using pattern language. I'm coming to the community because I'm having trouble getting the fields and values ​​from a json format that comes from log ingestion. The Json format is the following. I've managed to get the value up to this point, but I can't extract the information. I'm interested in getting the "accountNumber" and "transferType" fields. Maybe you can help me with your experience in this.

  "valor": "Sending. data: {\"ordererDetails\":{\"accountInfo\":\"YES\",\"customerInfo\":{\"firstName\":\"FISRT\"}},\"beneficiaryDetails\":{\"accountInfo\":{\"accountNumber\":\"111111\",\"accountType\":\"AAA\"},\"customerInfo\":{\"firstName\":\"FABS FABS\",}},\"transferDetails\":{\"transferType\":\"CASH_NOW\",\"amount\":10}}. trackingId: 111"

[erh_inetum · Accepted solution]

Hi Jhon,

I think this could work:

PARSE(content,"JSON:parsedJson")| FIELDS_ADD(accountNumber: parsedJson["accountNumber"],transferType:parsedJson["transferType"])
| FIELDS_REMOVE(parsedJson)

Test the rule before enabling the rule.

Here you have examples.

Hope it helps.

Regards,

Elena.

[JhonU]

thanks so much