I have a logstatement that contains a json.
I am able to parse the json as field. I am also able to parse each field of the json. But only each field by hand.
Is there anyway of like parsing all 1st level fields by hand?
Be careful with this though as this can use a ton of memory and disk on a search if you have a large amount of data. It's better to identify what fields you need from the json and do either rex or eval spath the fields out like you have been, but if that is not working for you the above method will accomplish what you are asking for.
If this comment/answer was helpful, please up vote it. Thank you.