cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Log Processing extract field from JSON array - parsing json

NicolasT
Guide

Hello the community,

 

I try to build a Log processing parsing rule with a flat json (here attached expanded).

I would like to extract and define columns in logs menu with the values in the "inputs" array of :

- name

- kind

-status

 

I tried different syntax with json array etc but nothing is working and I am puzzled.

 

I was able to extract some simple values with this rule and a raw "inputs" json :

 

PARSE(content, "JSON{ STRING:level:status, JSON{ JSON_ARRAY{}:inputs, JSON{STRING:country, STRING:job,STRING:kubernetesContext,STRING:platform}:executionContext }:message }(flat=true)")
| FIELDS_ADD(country: message["executionContext"]["country"], kind: message["kind"], input: message["inputs"])

 

But I'm not able to extract and forge fields within inputs array.

How do we do that ?

 

Thank you,

Nicolas.

 

0 REPLIES 0