# Json Lists Help

**URL:** <https://community.graylog.org/t/json-lists-help/16480>\
**Category:** Graylog Central (peer support)\
**Created:** [July 22, 2020, 4:05pm UTC](https://community.graylog.org/t/json-lists-help/16480 "2020-07-22T16:05:33Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![reconluke](https://avatars.discourse-cdn.com/v4/letter/r/e19b73/32.png) [@reconluke](https://community.graylog.org/u/reconluke)\
**Post date:** [July 22, 2020, 4:05pm UTC](https://community.graylog.org/t/json-lists-help/16480/1 "2020-07-22T16:05:33Z")

</div>

I have a field that contains valid json wrapped in brackets, example: [{“Href”:“https[:]//protection[.]office[.]com/viewalerts?id=randomchars”,“Category”:null,“Label”:“alert”,“Type”:“webLink”}]

What is the best way to get this json parsed? Should I trim, do a replace [{ with { and }] with }, something else?

Any help would be appreciated.

Thanks,

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [July 23, 2020, 10:41am UTC](https://community.graylog.org/t/json-lists-help/16480/2 "2020-07-23T10:41:22Z")

</div>

You can use for example this snippet. If you want to prefix fields from json replace “prefix\_” in function set\_field and uncomment line and comment previous one.

```auto
rule "extract-json"
when
    has_field("json_field")
then
    let extractjson = regex(pattern: "\\[(\\{.*\\})\\]", value: to_string($message.json_field));
    let json = parse_json(to_string(extractjson["0"]));
    let map = to_map(json);
    set_fields(map);
    // Optionally add prefix "prefix_" to json fields
    //set_fields(map, "prefix_");
    
    // Optionally replace [:.] in URL in field prefix_Href
    //let fix_url = regex_replace("\\[(:|.)\\]", to_string($message.prefix_Href), "$1");
    //set_field("prefix_Href", fix_url);
    
    // Optionally remove field
    //remove_field("json_field");
    
    // Optionally rename one of the field
    //rename_field("prefix_Href", "URL");
end

```

---

<div class="post-metadata">

**Author:** ![reconluke](https://avatars.discourse-cdn.com/v4/letter/r/e19b73/32.png) [@reconluke](https://community.graylog.org/u/reconluke)\
**Post date:** [July 23, 2020, 7:47pm UTC](https://community.graylog.org/t/json-lists-help/16480/3 "2020-07-23T19:47:58Z")

</div>

Hey thanks for providing that snippet. I tried to use it and unfortunately it did not parse out the fields from that json list. Here is the updated snippet with the fields added in:

```auto
rule "normalize_entities"
when
    has_field("Entities")
then
    let extractjson = regex(pattern: "\\[(\\{.*\\})\\]", value: to_string($message.Entities));
    let json = parse_json(to_string(extractjson["0"]));
    let map = to_map(json);
    set_fields(map);
    // Optionally add prefix "prefix_" to json fields
    set_fields(map, "entities_");

end

```

I’m not sure what I am missing here, but this looks correct based on the snippet you provided. I also ran the json list thru a regex checker using the regex you provided and seems like it should have worked. Any thoughts?

Thanks,

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [July 24, 2020, 7:43am UTC](https://community.graylog.org/t/json-lists-help/16480/4 "2020-07-24T07:43:32Z")

</div>

Please don’t use set\_fields several times:

1. If you want to create field names based on json, use line: `set_fields(map);`
2. If you want to add prefix to field names, use line: `set_fields(map, "entities_");`

Use one of the line, but not both.

Try to debug, if regex works for you, add:

```auto
let debug_message = concat("Regex check: ", extractjson);
debug(debug_message);

```

And check graylog log file: `/var/log/graylog-server/server.log`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [August 7, 2020, 7:43am UTC](https://community.graylog.org/t/json-lists-help/16480/5 "2020-08-07T07:43:43Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.