JSON Split at Index Time

[krishnakesiraju]

Hi all,

I have a JSON file output from a RESTful API service and the log looks something like this:

{
"Provider": "Provider1",
"AccountId": "Account1",
"Status": "NON_COMPLIANT",
"AggregatedStatus": {
"Control1": "COMPLIANT",
"Control2": "NON_COMPLIANT",
"Control3": "COMPLIANT"
},
"ResourceCounter": 3,
"DetailedResult": [
{
"RuleName": "Rule1",
"ResourceID": "ID65329083",
"ResourceType": "Type1",
"Timestamp": "2019-07-25T06:53:13.030000",
"Status": "NON_COMPLIANT",
"Severity": "medium",
"Category": "Control1",
"SubCategory": "SubCat1"
},
{
"RuleName": "Rule2",
"ResourceID": "ID234ti4",
"ResourceType": "Type1",
"Timestamp": "2019-07-25T06:53:13.030000",
"Status": "NON_COMPLIANT",
"Severity": "medium",
"Category": "Control2",
"SubCategory": "SubCat2"
},
{
"RuleName": "Rule3",
"ResourceID": "ID7523427",
"ResourceType": "Type1",
"Timestamp": "2019-07-25T06:53:13.030000",
"Status": "NON_COMPLIANT",
"Severity": "medium",
"Category": "Control3",
"SubCategory": "SubCat3"
}
]
}

Is it possible to split the JSON into multiple events and filter/index the output based on "Category": "Control2". Ideally, I would like to view the broken down events like this and may be filter events based on the "Category" field. Is this even possible?

{
"Provider": "Provider1",
"AccountId": "Account1",
"Status": "NON_COMPLIANT",
"AggregatedStatus": {
"Control1": "COMPLIANT"
},
"ResourceCounter": 1,
"DetailedResult": [
{
"RuleName": "Rule1",
"ResourceID": "ID65329083",
"ResourceType": "Type1",
"Timestamp": "2019-07-25T06:53:13.030000",
"Status": "NON_COMPLIANT",
"Severity": "medium",
"Category": "Control1",
"SubCategory": "SubCat1"
}
]

}

{
"Provider": "Provider1",
"AccountId": "Account1",
"Status": "NON_COMPLIANT",
"AggregatedStatus": {
"Control2": "NON_COMPLIANT"
},
"ResourceCounter": 1,
"DetailedResult": [
{
"RuleName": "Rule2",
"ResourceID": "ID234ti4",
"ResourceType": "Type1",
"Timestamp": "2019-07-25T06:53:13.030000",
"Status": "NON_COMPLIANT",
"Severity": "medium",
"Category": "Control2",
"SubCategory": "SubCat2"
}
]
}

---

{
"Provider": "Provider1",
"AccountId": "Account1",
"Status": "NON_COMPLIANT",
"AggregatedStatus": {
"Control3": "COMPLIANT"
},
"ResourceCounter": 1,
"DetailedResult": [
{
"RuleName": "Rule3",
"ResourceID": "ID7523427",
"ResourceType": "Type1",
"Timestamp": "2019-07-25T06:53:13.030000",
"Status": "NON_COMPLIANT",
"Severity": "medium",
"Category": "Control3",
"SubCategory": "SubCat3"
}
]
}

Thanks,
Krishna

[richgalloway]

I think you need to create a scripted input to break the file up like that.