The structure of JSON in my log events is roughly as follows
{
"Info": {
"Apps": {
"ReportingServices": {
"ReportTags": [
"Tag1"
],
"UserTags": [
"Tag2",
"Tag3"
]
},
"MessageQueue": {
"ReportTags": [
"Tag1",
"Tag4"
],
"UserTags": [
"Tag3",
"Tag4",
"Tag5"
]
},
"Frontend": {
"ClientTags": [
"Tag12",
"Tag47"
]
}
}
}
}
The number of fields in "Apps" is unknown, as are their names. Given this structure I need to check if a given tag ("Tag1", "Tag2", ...) exists in in a given array ("ReportTags", "UserTags", [..]), regardless of parent. If it does, I need the distinct names of parent field names that contain this.
Example 1: The input to the query is "ReportTags" and "Tag1". I'd expect it to output both "ReportingServices" and "MessageQueue" because both of them contain a "ReportTags" array that contains "Tag1".
Example 2: The input to the query is "UserTags" and "Tag5". I'd expect it to output only "MessageQueue" because only this one contains a "UserTags" array that contains this "Tag5".
I have looked at various questions on this forum, tried various combinations of mvexpand and such but I have not been able to write a query that does exactly this. Any hints and/or help would be greatly appreciated.
Something like this?
| spath
| foreach *.ReportTags*
[| eval fields=if(isnotnull(mvfind('<<FIELD>>',"Tag1")), if(isnull(fields),"<<MATCHSEG1>>",mvappend(fields,"<<MATCHSEG1>>")), fields)]