How to retrieve nested json in fetch logs

[dkroger]

Hello team,

I having trying to get some fields from keda controller in kubernetes using fetch logs, this query is almost there but missing some nested json values

fetch logs
| filter matchesValue(k8s.namespace.name, "keda")
| sort timestamp desc
| parse content, "LD JSON:json"
| fieldsFlatten  json, fields:{type,namespace,name, error}
| parse error, "LD JSON:error_log"
| fields timestamp, name, namespace, error_log

I'm able to get the error log which shows as an actual json:

{
  "error": {
    "code": "404",
    "message": "Resource not found. The requested item could not be located.",
    "status": "NOT_FOUND",
    "details": [
      {
        "@type": "type.googleapis.com/google.rpc.ResourceInfo",
        "resourceType": "exampleResource",
        "resourceName": "sample-id-123",
        "owner": "sample-owner",
        "description": "The resource with the given ID does not exist."
      }
    ]
  }
}

How can I get the message, status and owner in my query above? 

[darya-ramashko]

Hello,

You could try something like this:

fetch logs
| filter matchesValue(k8s.namespace.name, "keda")
| sort timestamp desc
| parse content, "JSON:json"
| fieldsFlatten json, fields:{type,namespace,name}
| fieldsAdd errorMessage = json[error][message], errorStatus = json[error][status], errorOwner=json[error][details][0][owner]
| fields timestamp, type, name, namespace, errorMessage, errorStatus, errorOwner

Hope that helps,

Darya