Hi, is there a function that I can use in Graylog when a json key has a complex value, like a list of element? I mean, if I have a json like: {"DeviceProperties":{Name=OS, Value=MacOs}, {Name=BrowserType, Value=Chrome}} is there something that can be used to map all of that list values? For exa…

I think there is a JSON extractor, there is also parse_json() in the pipeline that you can follow with a set_fields() there were some other posts around here with people using them…

Hi, I used the json Extractor but the result, for list object is not a valid json [image] It seems to be the java HashMap.toString method output instead. With this output I cannot work with it as a json

[image] gianluca-valentini: {“DeviceProperties”:{Name=OS, Value=MacOs}, {Name=BrowserType, Value=Chrome}} This isn’t a valid json either… :stuck_out_tongue: It’s hard to work with text from a screen shot, use the </> forum tool and paste in actual text. What does the original message look …

[image] gianluca-valentini: {“DeviceProperties”:{Name=OS, Value=MacOs}, {Name=BrowserType, Value=Chrome}} You are right. The original field contains the correct json text (before json exractor) {"DeviceProperties":[{"Name":"OS","Value":"MacOs"},{"Name":"BrowserType","Value":"Chrome"},{"Name…

If you find a solution in there - post it up for future searchers - otherwise continue to ask, we’ll figure it out together!

Try the flatten_json function with parameter array_handler = “flatten” https://docs.graylog.org/docs/functions-1#flatten_json

Hi @tmacgbay i solved creating my own function after remove double quote and using let json_tree = parse_json(to_string($message."message_unquote")); let jsonNode = to_map(json_tree); my function is named list_fieldKVMap where [image] for example: list_fieldKVMap(“DeviceProperties”, jsonNode…

Great! It would be interesting to have a write up on how to create your own function and put it in the “templates and rules exchange” section. :smiley:

JsonList parser

Graylog Central (peer support)

tmacgbay (Tmacgbay) May 25, 2022, 6:21pm 6

Hmmm… I did a little searching - this post here goes into more depth about json… it may help to find what you need…

Topic		Replies	Views
JSON extraction Graylog Central (peer support)	8	12976	March 6, 2018
JSON List Parsing Graylog Central (peer support)	4	746	March 22, 2019
Json Lists Help Graylog Central (peer support)	4	476	August 7, 2020
Json nested and lsit Pipeline Rules	9	803	April 15, 2024
Parsing JOSON in a pipeline Graylog Central (peer support)	1	826	July 22, 2019

JsonList parser

Related topics