How to extract a JSON from a JSON?

jochen · May 28, 2018, 3:47pm

You could try extracting/processing the nested JSON array with the select_jsonpath() function.

Graylog2/graylog-plugin-pipeline-processor/blob/2.4.5/plugin/src/test/resources/org/graylog/plugins/pipelineprocessor/functions/jsonpath.txt

rule "jsonpath"
when true
then
  let x = parse_json(to_string($message.message));
  let new_fields = select_jsonpath(x,
            { author_first: "$['store']['book'][0]['author']",
              author_last: "$['store']['book'][-1:]['author']"
            });
  set_fields(new_fields);

  // Don't fail on empty input
  let invalid_json = parse_json("#FOOBAR#");
  let invalid_json_fields = select_jsonpath(invalid_json, { some_field: "$.message" });
  set_fields(invalid_json_fields);

  // Don't fail on missing field
  let missing_fields = select_jsonpath(x, { some_field: "$.i_dont_exist", this_should_exist: "$['store']['book'][-1:]['author']" });
  set_fields(missing_fields);
end

Related resources:

Topic		Replies	Views
Can't extract from JSON Graylog Central (peer support) pipeline-rules	5	2049	September 7, 2020
JSON extraction Graylog Central (peer support)	8	12912	March 6, 2018
Where does json extracted logs go Graylog Central (peer support)	3	1236	March 26, 2018
JSON extractor not working? Graylog Central (peer support)	5	4831	September 24, 2018
Parsing nested JSON message Graylog Central (peer support)	1	1173	October 16, 2019

How to extract a JSON from a JSON?

Related topics