Can I get value from JSON data by name, after set_field on $message?


I’m trying to parse JSON string at first stage, then handle the data in different rules by it’s “type” at second stage, but it seems that “type” always is NULL.

Here are the rules:

stage 0:

let message = parse_json(to_string(body.json_str));
set_field("data", message);

stage 1:

when true

debug output:
org.graylog.plugins.pipelineprocessor.ast.functions.Function - PIPELINE DEBUG: Passed value is NULL.

Am i using it wrong way? please correct me.


the function parse_json returns a json tree ( ) you need select the fields you want to extract with select-jsonpath ( ).

The intention you have, parse json and write it like Key=Value into new fields is currently not possible.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.