Need hep in pulling nested json log line as seprate line with DPL

[Dest-Roh]

Hi Team i need an help in converting below nested json to multiple lines in log processing rule with DPL syntax but unfortunately i am  unable to pull all record.

Additinalinfo:
DATA DETAILS:
{ "Report":[{"SessionID":300,"BlockingSessionID":821,"BlockedSessionCount":0,"Status":"suspended","OpenTranCount":0,"HostName":"xyx","DBName":"xyz","StartTime":"2026-04-01T13:24:23.003"},
{"SessionID":300,"BlockingSessionID":821,"BlockedSessionCount":0,"Status":"suspended","OpenTranCount":0,"HostName":"mmy","DBName":"abc","StartTime":"2026-04-01T13:24:23.003"},
{"SessionID":300,"BlockingSessionID":821,"BlockedSessionCount":0,"Status":"suspended","OpenTranCount":0,"HostName":"wwe","DBName":"tzt","StartTime":"2026-04-01T13:24:23.003"}]}

the numbers of record may increase so DPL should be dynamic to keep that new nested lines as new record from json

[MaximilianoML]

Hello @Dest-Roh 

Let's me try to help you in this one,

I'm not sure if I understood correctly but what you want here it'll only map to a single Dynatrace log record, and looking into the data you put you have more than one log in the record. Anyway, the DPL should be something like this bellow: 

(BOF '[')?
JSON_OBJECT{
  LONG+:SessionID,
  LONG:BlockingSessionID,
  LONG:BlockedSessionCount,
  STRING:Status,
  LONG:OpenTranCount,
  STRING:HostName,
  STRING:DBName,
  TIMESTAMP("yyyy-MM-dd'T'HH:mm:ss.SSS"):StartTime
}:record ','?
(']' EOF)?

I would say that the best approach is to split the payload before ingestion, so each Report item is sent as its own log record. This subject isn't my strongest point, maybe someone else could add more info here.

[Dest-Roh]

This logic is able to pull the first record only but other record separated by comma its not picking UP {[{record1},{record2},{record3}]}

Need to seperate as 

{Record1}

{Record2}

{Record3}

[MaximilianoML]

Humm.... Okay.

Maybe this one, now ChatGPT is helping me: 

(BOF '{' SPACE? '"Report"' SPACE? ':' SPACE? '[')?

JSON_OBJECT{
  LONG+:SessionID,
  LONG:BlockingSessionID,
  LONG:BlockedSessionCount,
  STRING:Status,
  LONG:OpenTranCount,
  STRING:HostName,
  STRING:DBName,
  TIMESTAMP("yyyy-MM-dd'T'HH:mm:ss.SSS"):StartTime
}:record ','?

(']' SPACE? '}' EOF)?

[krzysztof_hoja]

Unfortunalty it is not possible to do just with DPL. You need expand from DQL to do this transformation:

data record(content="""{ "Report":[{"SessionID":300,"BlockingSessionID":821,"BlockedSessionCount":0,"Status":"suspended","OpenTranCount":0,"HostName":"xyx","DBName":"xyz","StartTime":"2026-04-01T13:24:23.003"},
{"SessionID":300,"BlockingSessionID":821,"BlockedSessionCount":0,"Status":"suspended","OpenTranCount":0,"HostName":"mmy","DBName":"abc","StartTime":"2026-04-01T13:24:23.003"},
{"SessionID":300,"BlockingSessionID":821,"BlockedSessionCount":0,"Status":"suspended","OpenTranCount":0,"HostName":"wwe","DBName":"tzt","StartTime":"2026-04-01T13:24:23.003"}]} """)
| parse content, """JSON:record"""
| expand record=record[Report]
| fields record