How to extract fields if the event is in JSON format?

[maityayan1996]

Hi,

I have a below event in json format, I want the fields to be created as "key1","key2",etc. I am trying the following code but it is not working:

index="BBB"   sourcetype=AAA | spath output=AA path=message.eumObject.eumInfo.customKeys.key1

Please HELP !!

 level:  info   
     message:    {"eumObject":{"eumInfo":{"eumId":"123456","eumCoRelationId":"","appId":"xxxxx","timeStamp":"2018-08-1316:21:16","pageUrl":"yyyyyy","pageName":"Operations","mmmmm":"","server":"","responseTime":833,"totalResponseTime":1679.081623,"projectId":""},"timingInfo":{"navigationStart":0,"unloadEventStart":0,"unloadEventEnd":0,"redirectStart":0,"redirectEnd":0,"fetchStart":4,"domainLookupStart":4,"domainLookupEnd":4,"connectStart":4,"connectEnd":4,"secureConnectionStart":0,"requestStart":4,"responseStart":17,"responseEnd":17,"domLoading":23,"domInteractive":803,"domContentLoadedEventStart":844,"domContentLoadedEventEnd":850,"domComplete":1169,"loadEventStart":1169,"loadEventEnd":1169},"userInfo":{"upi":"qqqqq","emailId":"","browserInfo":"Mozilla/5.0 (X11; Linux x86_64; rv:54.0) Gecko/20100101Firefox/54.0","timeZone":"","screenResolution":"1366x637"},"appInfo":{},"errorInfo":{"errorCode":"","errorDescription":"","errorType":""},"resourcesInfo":[],"customKeys":{"key1":833,"key2":1433,"key3":846,"key4":844,"key5":833,"key6":833,"key7":1067,"key8":"","key9":"","key10":""}}}   

[maityayan1996 · Accepted solution]

Well, I got the answer myself !!

Thanks a lot 🙂

index="BBB" sourcetype=AAA | spath input=message | rename "eumObject.customKeys.key1" as KEY1 ,"eumObject.customKeys.key2" as KEY2