Parse JSON log content

Malachi157 · ‎02 Apr 2025

Hello, I am trying to parse the scanActionCode and actionStation fields out of the content field in the logs. Here's a sample log. Please can someone help me with the dql to parse these fields out of the logs? Any help for be greatly appreciated!

2025-04-02T12:04:59.884Z INFO 1 --- [smartscan1732] [nio-8080-exec-3] s.l.RampGatewayLoggingRequestInterceptor : request to url : https://baggage-services.prd.adh.aws.ual.com/api/queryScan , body : {"bagReq":{"hdr":{"userID":"U392262","scannerInformation":{"scannerMACAddress":"02:00:00:00:00:00","scannerID":"392262","scannerSerialNumber":"22143B3AF4","version":"ZEBRA TC70_1.0.1740","dutyCode":null,"scannerIP":null},"localUploadTimeStamp":"2025-04-02T07:04:58","scanActionCode":"RFLF","actionStation":"ORD"},"flightInfo":null,"bagReqInfo":{"flightInfo":{"flightNumber":"0354","flightStatus":null,"carrierCode":"UA","departureStation":null,"arrivalStation":"ORD","gate":null,"arrivalGate":null,"departureGate":null,"noseNumber":null,"tailNumber":null,"localEstimateArrivalDate":null,"localScheduledArrivalDate":null,"equipmentCode":null,"localEstimatedDepartureDate":null,"localScheduledDepartureDate":null,"carrierType":null,"arrivalBagClaimUnitedID":null,"equipmentDescription":null,"isWideBody":null,"isInternational":null,"departureReasonCode":null,"arrivalReasonCode":null,"departureDate":"2025-04-01","fltLclOrigDt":null,"opsLegSequenceNumber":null,"seg":null,"acftNumber":null,"departureBagSectorNumber":null,"arrivalBagScreenAlert":null,"isFlightDepartureDiverted":null}}}}

mark_bley · ‎05 Apr 2025

how about this one:

data     record(data="""2025-04-02T12:04:59.884Z INFO 1 --- [smartscan1732] [nio-8080-exec-3] s.l.RampGatewayLoggingRequestInterceptor : request to url : https://baggage-services.prd.adh.aws.ual.com/api/queryScan , body : {"bagReq":{"hdr":{"userID":"U392262","scannerInformation":{"scannerMACAddress":"02:00:00:00:00:00","scannerID":"392262","scannerSerialNumber":"22143B3AF4","version":"ZEBRA TC70_1.0.1740","dutyCode":null,"scannerIP":null},"localUploadTimeStamp":"2025-04-02T07:04:58","scanActionCode":"RFLF","actionStation":"ORD"},"flightInfo":null,"bagReqInfo":{"flightInfo":{"flightNumber":"0354","flightStatus":null,"carrierCode":"UA","departureStation":null,"arrivalStation":"ORD","gate":null,"arrivalGate":null,"departureGate":null,"noseNumber":null,"tailNumber":null,"localEstimateArrivalDate":null,"localScheduledArrivalDate":null,"equipmentCode":null,"localEstimatedDepartureDate":null,"localScheduledDepartureDate":null,"carrierType":null,"arrivalBagClaimUnitedID":null,"equipmentDescription":null,"isWideBody":null,"isInternational":null,"departureReasonCode":null,"arrivalReasonCode":null,"departureDate":"2025-04-01","fltLclOrigDt":null,"opsLegSequenceNumber":null,"seg":null,"acftNumber":null,"departureBagSectorNumber":null,"arrivalBagScreenAlert":null,"isFlightDepartureDiverted":null}}}}""")
| parse data, "LD 'body : ' JSON:json"
| fieldsAdd scanActionCode = json[bagReq][hdr][scanActionCode]
| fieldsAdd actionStation = json[bagReq][hdr][actionStation]

Hope it helps.