Getting Data In

Json extraction with optional embedded element

Explorer

HI,
I am tryig to get elements extracted from array which looks like this :
{
"Version": 2,
"diagnostic": [
{
"name": "EMERGENCY_FUND",
"stringValue": " 6 months",
"isCohortUsed": true,
"cohortDefaultCode": "EX"
},
{
"name": "RATE",
"doubleValue": 0,
"isCohortUsed": true,
"cohortDefaultCode": "WR"
},
{
"name": "CHANCE",
"score": {
"scorevalue": 10,
"valueType": "PERCENT"
},
"stringValue": "likely",
"isCohortUsed": true,
"cohortDefaultCode": "CW"
}
}

Of alll this array, I want to extract element array score and its value for that respective Name i.e.

Name scorevalue
CHANCE 10

The score element may or may not be present in parent array element.

Thanks!

0 Karma
1 Solution

Esteemed Legend

Like this:

| rex field=_raw mode=sed "s/\"(doubleValue)\"/\"stringValue\"/g"
| rex field=_raw mode=sed "s/\"score\": {[\r\n\s]*\"scorevalue\": (\d*),[\r\n\s]*\"valueType\": \"(\w*)\"[\r\n\s]*},[\r\n\s]*\"stringValue\": \"(\w*)\",/\"stringValue\": \"\3 \1 \2\"/g"
| spath
| rename diagnostic{}.* AS *
| eval nameValue=mvzip(name,stringValue, "=")
| mvexpand nameValue | fields - name stringValue

View solution in original post

0 Karma

Esteemed Legend

Like this:

| rex field=_raw mode=sed "s/\"(doubleValue)\"/\"stringValue\"/g"
| rex field=_raw mode=sed "s/\"score\": {[\r\n\s]*\"scorevalue\": (\d*),[\r\n\s]*\"valueType\": \"(\w*)\"[\r\n\s]*},[\r\n\s]*\"stringValue\": \"(\w*)\",/\"stringValue\": \"\3 \1 \2\"/g"
| spath
| rename diagnostic{}.* AS *
| eval nameValue=mvzip(name,stringValue, "=")
| mvexpand nameValue | fields - name stringValue

View solution in original post

0 Karma