How to extract a field called "name"?

[ejose]

Hi,

I am ingesting a json data that has a property called "name". I could not figure out why I am not able to extract the "name" property as a field name. It also does not create the "name" field even if I use a filed extractor. I am how ever able to create a field called "name1" but if I change it back to "name" it again does not register the field.

Regards,

Edward

[scelikok · Accepted solution]

Hi @ejose,

I cannot think of a reason why "name" field name is not working, but if you managed to extract the field as "name1" you can simply rename it on search head on sourcetype settings. You will not need to rename everytime you need.

[scelikok]

Hi @ejose,

If your event is proper JSON you can use spath command. It will extract all fields,

index=json_data | spath

If you have mix data containing some JSON fields inside an event, you can use spath only for that field;

Assuming your json field name is json_field

index=json_data | spath input=json_field

[ejose]

Hi @scelikok ,

Thanks for the reply, but I wanted to extract the field at index time so I can filter it with out having to extract the field every search.