Json extraction with optional embedded element

psable — Sun, 03 Jul 2016 13:21:43 GMT

HI,
I am tryig to get elements extracted from array which looks like this :
{
"Version": 2,
"diagnostic": [
{
"name": "EMERGENCY_FUND",
"stringValue": " 6 months",
"isCohortUsed": true,
"cohortDefaultCode": "EX"
},
{
"name": "RATE",
"doubleValue": 0,
"isCohortUsed": true,
"cohortDefaultCode": "WR"
},
{
"name": "CHANCE",
"score": {
"scorevalue": 10,
"valueType": "PERCENT"
},
"stringValue": "likely",
"isCohortUsed": true,
"cohortDefaultCode": "CW"
}
}

Of alll this array, I want to extract element array score and its value for that respective Name i.e.

Name scorevalue
CHANCE 10

The score element may or may not be present in parent array element.

Thanks!

Re: Json extraction with optional embedded element

woodcock — Sun, 03 Jul 2016 18:43:12 GMT

Like this:

| rex field=_raw mode=sed "s/\"(doubleValue)\"/\"stringValue\"/g"
| rex field=_raw mode=sed "s/\"score\": {[\r\n\s]*\"scorevalue\": (\d*),[\r\n\s]*\"valueType\": \"(\w*)\"[\r\n\s]*},[\r\n\s]*\"stringValue\": \"(\w*)\",/\"stringValue\": \"\3 \1 \2\"/g"
| spath
| rename diagnostic{}.* AS *
| eval nameValue=mvzip(name,stringValue, "=")
| mvexpand nameValue | fields - name stringValue

topic Json extraction with optional embedded element in Getting Data In

Json extraction with optional embedded element

Re: Json extraction with optional embedded element