How to extract elements of a json (not a json array)

[weidertc]

I have a json from Grafana.

| makeresults count=1
| eval json = "{
  \"datasources\": {
    \"ds_a\": {},
    \"ds_b\": {},
    \"ds_c\": {}
  }
}"
| eval json_valid = if(json_valid(json), "Valid", "Invlaid")
| spath input=json path=datasources{} output=datasources

the only other relative piece of information not shown above is some values within the inner braces themselves contain braces, so using a regex unfortunately hasn't worked.

I need to extract the elements of "dataSources", but the | spath is not working.

I need a multivalue field like this

\"ds_a\": {}
\"ds_b\": {}
\"ds_c\": {}

How can i do this when dataSources is not a [] ?

[PickleRick]

You want a multivalued field with each field being a "crippled json"?

You could use json_keys() and then do some sort of foreach-based eval.

[ITWhisperer · Accepted solution]

| makeresults count=1
| eval json = "{
  \"datasources\": {
    \"ds_a\": {},
    \"ds_b\": {},
    \"ds_c\": {}
  }
}"
| eval json_valid = if(json_valid(json), "Valid", "Invlaid")
| eval keys = json_keys(json)
| eval datasources = json_extract(json,json_array_to_mv(keys))
| eval datasources_keys = json_keys(datasources)
| eval mv_keys=json_array_to_mv(datasources_keys)
| foreach mode=multivalue mv_keys
    [| eval array=if(isnull(array),"\"".<<ITEM>>."\": ".json_extract(datasources,<<ITEM>>),mvappend(array,"\"".<<ITEM>>."\": ".json_extract(datasources,<<ITEM>>)))]

[weidertc]

thanks, this is it.

i updated it so it isn't "crippled" (per other comment) for those who need this instead.  it need not result in valid json for me.

| makeresults count=1
| eval json = "{
\"datasources\": {
\"ds_a\": {},
\"ds_b\": {},
\"ds_c\": {}
}
}"
| eval json_valid = if(json_valid(json), "Valid", "Invlaid")
| eval keys = json_keys(json)
| eval datasources = json_extract(json,json_array_to_mv(keys))
| eval datasources_keys = json_keys(datasources)
| eval mv_keys=json_array_to_mv(datasources_keys)
| foreach mode=multivalue mv_keys
[| eval array=if(isnull(array), "{\"".<<ITEM>>."\": ". json_extract(datasources,<<ITEM>>) . "}", mvappend(array,"{\"" . <<ITEM>> . "\": " . json_extract(datasources,<<ITEM>>) . "}"))]

 Thanks for your help!

[yuanliu]

This can be further simplified using the json_array mode of foreach.

| makeresults count=1
| eval json = "{
  \"datasources\": {
    \"ds_a\": {},
    \"ds_b\": {},
    \"ds_c\": {}
  }
}"
| spath input=json path=datasources

| eval key = json_keys(datasources)
| foreach key mode=json_array
    [ eval object = mvappend(object, '<<ITEM>>' . ":" . spath(datasources, <<ITEM>>)) ]

[weidertc]

this also works well.

Adding in the surrounding {} for those who need the result as valid json.

| makeresults count=1
| eval json = "{
  \"datasources\": {
    \"ds_a\": {},
    \"ds_b\": {},
    \"ds_c\": {}
  }
}"
| spath input=json path=datasources

| eval key = json_keys(datasources)
| foreach key mode=json_array
    [ eval object = mvappend(object, "{\"" . <<ITEM>> . "\": " . spath(datasources, <<ITEM>>) . "}") ]