Can I get value from JSON data by name, after set_field on $message?

[gaoge]

Hello,

I’m trying to parse JSON string at first stage, then handle the data in different rules by it’s “type” at second stage, but it seems that “type” always is NULL.

Here are the rules:

stage 0:

let message = parse_json(to_string(body.json_str));
set_field("data", message);

stage 1:

when true
then
  debug($message.data.type);

debug output:
org.graylog.plugins.pipelineprocessor.ast.functions.Function - PIPELINE DEBUG: Passed value is NULL.

Am i using it wrong way? please correct me.

Thanks!

[jan (Jan Doberstein)]

the function parse_json returns a json tree ( http://docs.graylog.org/en/2.4/pages/pipelines/functions.html#parse-json ) you need select the fields you want to extract with select-jsonpath ( http://docs.graylog.org/en/2.4/pages/pipelines/functions.html#select-jsonpath ).

The intention you have, parse json and write it like Key=Value into new fields is currently not possible.