Pipeline output printing in array instead of string

Templates and Rules Exchange Pipeline Rules
1

I have the below pipeline processor rule that allows me to extract connectionId, ns and type from the mongodb log(json format), but unfortunately the extracted output is displaying as array instead of string.

rule “Extracting ConnectionId”
when
has_field(“message”)
then
let json_msg = parse_json(to_string($message.message));
let json_field = select_jsonpath(json_msg,{ctx: “.ctx”, ns: “.attr.ns”, type: “.attr.type”});
set_field(“ctx”,to_string(json_field.ctx));
set_field(“ns”, to_string(json_field.ns));
set_field(“type”, to_string(json_field.type));
end

image
image2944×1400 420 KB

Need your assistance in displaying the output to be in string format for better filtering of messages with the defined field

2

Hello @venki,

I wonder if mapping the parsed json using to_map and then the set_fields function would make any difference here.

3

@Wine_Merchant After updating the rule with below syntax, i can able to fetch the json output in string format(we missed $ while fetching ctx)

rule “Bureau Search”
when
has_field(“message”)
then
let json_msg = parse_json(to_string($message.message));
let json_field = select_jsonpath(json_msg,{ctx: “$.ctx”, ns: “$.attr.ns”, type: “$.attr.type”});
set_field(“ctx”,to_string(json_field.ctx));
set_field(“ns”, to_string(json_field.ns));
set_field(“type”, to_string(json_field.type));
end

1 Like