Parse JSON Data Using DQL for Advanced Querying

[yeyelka5]

Could you help me parse this log?

 },
"logger" : "******************",
"message" : "Detalle error respuesta API, nit real ********02464,fecha inicial 2025-11-21 , fecha final 2025-11-23 página 0 . Datos cuenta: [**********] -> {\"meta\":{\"_messageId\":\"**************\",\"_requestDateTime\":\"2025-11-25T07:09:51.993-05:00\",\"_applicationId\":\"6***c2\"},\"status\":404,\"title\":\"Not Found\",\"errors\":[{\"code\":\"BPQR-E0001\",\"detail\":\"No se encontró información relacionada con la consulta.\"}]}",
"context" : "default"
}{

I would like to extract the "message" and "status" using a DQL query.

[mark_bley · Accepted solution]

something like this could work:

data record(content="{\"logger\":\"**************\",\"message\":\"Detalle error respuesta API, nit real ********02464,fecha inicial 2025-11-21 , fecha final 2025-11-23 página 0 . Datos cuenta: [] -> {\\\"meta\\\":{\\\"_messageId\\\":\\\"**\\\",\\\"_requestDateTime\\\":\\\"2025-11-25T07:09:51.993-05:00\\\",\\\"_applicationId\\\":\\\"6*c2\\\"},\\\"status\\\":404,\\\"title\\\":\\\"Not Found\\\",\\\"errors\\\":[{\\\"code\\\":\\\"BPQR-E0001\\\",\\\"detail\\\":\\\"No se encontró información relacionada con la consulta.\\\"}]}\",\"context\":\"default\"}")
| parse content, """JSON:data"""
| parse data[message], """LD ' -> ' JSON:embedded_data"""
| fields data[message], embedded_data[status]