topic Extracting specific JSON field where duplicate exists within array in Getting Data In

Extracting specific JSON field where duplicate exists within array

greatapoc — Mon, 23 Oct 2017 21:30:02 GMT

I have a JSON feed that I'm trying to parse fields in and the event contains fields with identical names but are different based on the "measurementType" field. What search can I run to pull the specific data based on the measurementType? For example, if I do a search spath consumption{}.wNow it will return both 405.878 and -2980.273. I want to be able to pull each out separately. Thank you

Re: Extracting specific JSON field where duplicate exists within array

kyaparla — Tue, 24 Oct 2017 00:03:12 GMT

There is no direct way, since its an array of json objects, and each field is multivalue field. You would probably want wNow value along with other values in the same array right?

Need to break each json object as individual json event and following search helps do that.

your search | rex mode=sed "s/^\{\"\w+\"\:\s*\[//g" | rex mode=sed "s/\]\}$//g" | rex mode=sed "s/\},\{/}\n{/g" | multikv noheader=t

first line above removes this text from the event "{"consumption": [
second line removes ]}
third line inserts new line char between each json object in json array.
fourth one breaks each line in to separate event.

Re: Extracting specific JSON field where duplicate exists within array

Damien_Dallimor — Tue, 24 Oct 2017 00:57:36 GMT

You can create fields at search time with eval based on the value of a field by using curly braces.

So something like this might solve your problem.

... | eval consumption.{measurementType}.wNow = 'consumption.wNow' | table consumption*