topic How to extract sub-element data from a JSON message: In the event below, i want to extract from MessageBody, the subdata under Request like businessId, partnerEBID and also some fields from the Response section like branchCode in Getting Data In

How to extract sub-element data from a JSON message: In the event below, i want to extract from MessageBody, the subdata under Request like businessId, partnerEBID and also some fields from the Response section like branchCode

besa0903 — Sun, 18 Mar 2018 14:45:58 GMT

{

cid: abcde

d: 1211

environment: nonProd

log: request

messageBody:

}

Re: How to extract sub-element data from a JSON message: In the event below, i want to extract from MessageBody, the subdata under Request like businessId, partnerEBID and also some fields from the Response section like branchCode

FeatureCreeep — Mon, 19 Mar 2018 02:39:14 GMT

This should be a straight forward regular expression extract. Some of the formatting of your JSON looks strange though, with strange characters in it like where the "∂" where I think you expected "partnerEBID" to be. I also don't see a branchCode but I do see a brandCode. I'm not a JSON expert but that value for the brandCode doesn't look like valid JSON to me. If the value is supposed to be an empty string, it should be 2 sets of double quotes, not just 1. Anyway, with the data provided, I created a very simple regular expression. I'm sure there are better ways to write it but this is the easiest thing that works. I think you can extrapolate from here to extract more fields with this expression.

| rex field=_raw "businessId=(?P<businessId>\d+).*EBID=(?P<partnerEBID>\d+)"

Re: How to extract sub-element data from a JSON message: In the event below, i want to extract from MessageBody, the subdata under Request like businessId, partnerEBID and also some fields from the Response section like branchCode

besa0903 — Mon, 19 Mar 2018 19:14:49 GMT

Great, thanks a bunch. It works like a charm.