I’m looking to parse a JSON structure which contains lists. The JSON extractor finds nothing if the entire JSON structure with brackets is provided. I’ve included an example below along with the fields that I would like to pull out as pairs. How can I do this?
[{"findings":[{"group":"<KEY I WANT TO EXTRACT>","threatFactors":["<DATA TO KEY - CAN BE A LIST>"]},{"group":"<2nd KEY>","threatFactors":["DATA2 TO KEY]}],"metadata":{"appName":"1234","packageName":"com.sample.model","type":"app"}}]
Any ideas? Is this a new feature for the product?
http://json.parser.online.fr/
check this
it shows an syntax error in your json.
"threatFactors":["DATA2 TO KEY]}],"metadata"
where is the close of " ?
open of last ] ?
open of last } ?
When I manually replaced the data with DATA2 TO KEY for this posting – I inadvertently removed that quota but it exists in the data stream I’m sending to Graylog. Here is another sample with proper quotes/brackets:
[{"findings":[{"group":"AD_MALWARE","threatFactors":["ADNET"]},{"group":"MALWARE","threatFactors":["MALWARE"]}],"metadata":{"appName":"test","packageName":"com.test.model","type":"app"}}]
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.