Need help in DQL to expand columns

[imsummii]

Hello Community, 

We need help in one of the DQL to expand one of the columns which are in JSON. We got to this final column from nested jsons and previously in the same query used "fieldsFlatten"  to flatten a single nested row to many rows. But the flatten rows are not getting expanded. This is required to create a dashboard for the data.

Query::

fetch logs
| filter matchesValue(aws.account.id, "674210405359")
| filter dt.security_context == "14025"
| filter aws.log_group == "/mcs-ops-remote-patching/"
| fieldsKeep content
| parse content, "JSON:data_payload"
| fieldsFlatten data_payload, depth: 10

| expand data_payload.StepExecutions

| fields data_payload.StepExecutions, data_payload.Account_Id, data_payload.Region_Name, data_payload.ProductID
| fieldsFlatten data_payload.StepExecutions, depth: 10
| filter data_payload.StepExecutions.StepName == "PostPatching_notification" or data_payload.StepExecutions.StepName == "patch_summary"

| fieldsKeep data_payload.StepExecutions.Outputs.patchsummary
| expand data_payload.StepExecutions.Outputs.patchsummary, limit: 10

[krzysztof_hoja]

fieldsFlatten does not "flatten a single nested row to many rows". expand command can expand single field being an array into multiple rows.

data_payload.StepExecutions.Outputs.patchsummary seems to be just object (or maybe string representing object?), so applying expand on it does not change anything