Query and Parse JSON Data Using DQL for Structured Analysis

[ramchandgadde]

Could you help extracting all fields from JSON.

below is my query that returns JSON. But how to extract all fields?

data record(content = "[DEBUG][FILE][WATCHER] 2025-10-02 06:04:21.132 Ally UUID: s3_ALFA_WDFINBAL5_INT_IB_592e9bc0abae42649b9ed349e7039157 Application:ALFA_WDFINBAL5_INT_IB Intercept Lambda Event:{'Records': [{'eventVersion': '2.1', 'eventSource': 'aws:s3', 'awsRegion': 'us-east-1', 'eventTime': '2025-10-02T06:04:18.307Z', 'eventName': 'ObjectCreated:Put', 'userIdentity': {'principalId': 'AWS:AIDAQV7FB7VS6YFJ7SCRZ'}, 'requestParameters': {'sourceIPAddress': '444.44.88.44'}, 'responseElements': {'x-amz-request-id': '4444', 'x-amz-id-2': 'dsfdsfdsf'}, 's3': {'s3SchemaVersion': '1.0', 'configurationId': 'tf-s3-lambda-20250207135221620300000006', 'bucket': {'name': 'eap-s3-data-link-444-upload', 'ownerIdentity': {'principalId': 'dsfdf'}, 'arn': 'arns3:::eap-s3-data-link-201164-cap-us-east-1-eap-s3-upload'}, 'object': {'key': 'ALFA_WDFINBAL5_INT_IB/FINT091_IB_ALFA_AC_SAPGLAccts_Bal5_20251002005805.csv', 'size': 690, 'eTag': 'dfdf', 'versionId': '44_o73Yte5hklj5bjAamCR7', 'sequencer': '0068DE15E23267E9A2'}}}], 's3-uuid': 's3_ALFA_WDFINBAL5_INT_IB_592e9bc0abae42649b9ed349e7039157'}")
| filter contains(content, "Intercept Lambda Event")
| parse content, """LD 'Intercept Lambda Event:' JSON(strict=false):json"""
| fieldsFlatten json
| fields Records=json.Records

[dannemca · Accepted solution]

Use the command expand. At the end of your DQL, add: "| expand Records". Then keep expanding the fields that still has a json format as result and you need go deeper.

https://docs.dynatrace.com/docs/discover-dynatrace/platform/grail/dynatrace-query-language/commands/...