Activity Result: {"IsProductValidated":"false","ErrorCodes":[{"errorCode":"PRD-202","errorMessage":"Product Validation Service Returned Error :: Reason: Options you have selected are not available at this time. Please change your selections."}]}
You could use field extraction or the rex command.
| rex field="Activity Result" "Activity Result: {"IsProductValidated":"false","ErrorCodes":\[{"errorCode":"(?P<errorCode>\S+)","errorMessage":"(?P<errorMessage>.+)."}]}"
Hi @venkatanagendra ,
You do not need to do regex, as your data is already in structured json format. Ensure your sourcetype is using kv_mode=json or kv_mode=auto and you can address fields
ErrorCodes{}.errorCode ErrorCodes{}.errorMessage
Best regards,
Andreas
Thanks for your quick response schose...but if you see below image mentioned log comeing from (Alexinfomsg ) field, in this field Activity Result have Error code and Error message, these information we need to extract
Hi @venkatanagendra ,
If the json you provided is part of an already existing field i would go with eval json functions
| makeresults
| eval json = "{\"IsProductValidated\":\"false\",\"ErrorCodes\":[{\"errorCode\":\"PRD-202\",\"errorMessage\":\"Product Validation Service Returned Error :: Reason: Options you have selected are not available at this time. Please change your selections.\"}]}"
| eval errorCode = json_extract(json,"ErrorCodes{}.errorCode"), errorMessage = json_extract(json,"ErrorCodes{}.errorMessage")
| table _time errorCode errorMessage
Best Regards,
Andreas