How to extract a JSON from a JSON?

Graylog Central (peer support)
1

Background

One of our devices is sending us a message in JSON, that contains another JSON object inside.
I know I can use the default JSON extractor for the first level:

http://docs.graylog.org/en/2.4/pages/extractors.html#using-the-json-extractor

But I am not sure of what I can do for the second.

Message

{
   "imei":"35205",
   "messages":[
      {
         "d":"{\"n\":\"352094089228305\",\"b\":0,\"l\":1527068689,\"v\":\"03.00\",\"t\":2}"
      },
      {
         "d":"{\"n\":\"352094089228305\",\"b\":0,\"l\":1527069373,\"v\":\"03.00\",\"t\":1,\"d\":[[1527069373,0,0,0,0,1]]}"
      },
      {
         "d":"{\"n\":\"352094089228305\",\"b\":0,\"l\":1527069387,\"v\":\"03.00\",\"t\":2}"
      },
      {
         "d":"{\"n\":\"352094089228305\",\"b\":0,\"l\":1527069402,\"v\":\"03.00\",\"t\":2}"
      },
      {
         "d":"{\"n\":\"352094089228305\",\"b\":0,\"l\":1527069417,\"v\":\"03.00\",\"t\":2}"
      },
      {
         "d":"{\"n\":\"352094089228305\",\"b\":0,\"l\":1527069451,\"v\":\"03.00\",\"t\":1,\"d\":[[1527069451,0,0,0,0,1]]}"
      }
   ]
}

As you can see, this JSON object has 2 properties:

  • imei: the id of the device
  • messages: an array of messages

Each message of this array is a JSON object itself, which I also want to extract, but don’t know how to.

Problem

If I apply a JSON extractor to full_message ( which is what I do ) then I get an object with an imei, which is good and a messages array that contains a set of huge strings … which I don’t want, I actually want the contents of those strings !

Question

How can I extract the message object inside the messages array?

2

You could try extracting/processing the nested JSON array with the select_jsonpath() function.

Related resources:

3

Wweerrmmm… Aside from using pipelines, what other options do I have?

( still need to do a full read on pipelines, I am not familiar with them yet )

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.