Pipeline and JSON - Split message for each Key in JSON

Graylog Central (peer support)
1

Hi,
After extracting from message, we have a JSON value in a field that looks something like this: {“Key1”:“Value1”, “Key2”:“Value2”, “Key3”:“value3”}
The number of Keys may change.

I was asked to see if it was possible to split these message, for each Key in JSON, using a Pipeline.

Using JSON example, instead of 1 message with the JSON, we would have 3 different messages, all sharing same fields and values but each will also include a unique field with the name according to each of the Keys and it’s value. That means (using example) I would have 3 Messages instead of 1.

I hope that was clear.

I don’t have code yet to share, since right now I am trying to see if it is even possible.

Let me know if you need any other details.

2

Hello @mac3000

I believe there are other posts here for JSON Extractors/Pipelines that can be used/tested in your situation. If I understand this correctly

Here are some example:

  1. Parsing nested json message in field with parent object in pipeline - #9 by jivepig

  2. Failing JSON Extractor - #2 by benvanstaveren

  3. Extractors

  4. Sending in log data

3

Though I haven’t done it myself, you could probably accomplish this with the select_jsonpath and create_message functions.

1 Like
4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.