Filter events by length of json field

[ShagVT]

I'm trying put together a query to find some outlier events with very long values within a complex structure.

index=myindex sourcetype=jsonfile
| where len('x.y.z{}.field') > 20
| stats count by x.y.z{}.field

This is my first stab at how to do this, but it doesn't return any values, even though I know they are there.

[yuanliu]

I thought this was the same as my struggle with dereferencing JSON paths but it is not.  This has to do with using len() in where command with multivalue.  Here's a working filter:

|where isnotnull(len('x.y.z{}.field') > 20)
|stats count by x.y.z{}.field

Note, however, that count by an array field is not going to work too well if all you care are the values in the array whose length is greater than 20.  In that case you'll have to apply the filter again after stats, like

|where isnotnull(len('x.y.z{}.field') > 20)
|stats count by x.y.z{}.field
|where isnotnull(len('x.y.z{}.field') > 20)