Correlation of 2 fields within json array

[galsegal]

Hey All,

What I'm trying to do is to build a search query that correlates between fields like in the below example:

I need that where message.anomaly.features{}.anomaly has a true value, then to output a new field with the corresponding fields below - 23, location (Even only one of them is good for me)

How can I accomplish that?

Thank you,

[anmolpatel · Accepted solution]

@galsegal Is this what you're after ?

| makeresults
| eval _raw="{
    \"Features\": [
        { 
            \"anomaly\": false,
            \"id\" : 25,
            \"name\" : \"service\"
        },
        { 
            \"anomaly\": true,
            \"id\" : 23,
            \"name\" : \"location\"
        },
        { 
            \"anomaly\": false,
            \"id\" : 24,
            \"name\" : \"ip\"
        },
        { 
            \"anomaly\": false,
            \"id\" : 27,
            \"name\" : \"time\"
        }
    ]
}"
| rename COMMENT AS "The code below is what is needed. First extract each value from the tree, than we group and split them based on how they are related." 
| spath path="Features{}.anomaly" output=anomaly
| spath path="Features{}.id" output=id
| spath path="Features{}.name" output=name
| eval x = mvzip(mvzip(id, anomaly, "\n"), name, "\n")
| mvexpand x
| eval x=split(x,"\n")
| eval ID = mvindex(x, 0)
| eval Name = mvindex(x, 1)
| eval Anomaly = mvindex(x, 2)
| stats values(Name) as Name values(Anomaly) as Anomaly by ID

[galsegal]

This was not 100% the solution but it indeed got me there 🙂

Thank you very much, sir.