How to extract mutiple value from json

[zhenqi]

Hi,

I want to extract judgments to a fields from "37.0.10.15" and "47.105.153.104",

Is there any way it can do that?

{"data":{"37.0.10.15":{"severity":"medium","judgments":["Scanner","Zombie","Spam"],"tags_classes":[],"basic":{"carrier":"Delis LLC","location":{"country":"The Netherlands","province":"Zuid-Holland","city":"Brielle","lng":"4.16361","lat":"51.90248","country_code":"NL"}},"asn":{},"scene":"","confidence_level":"high","is_malicious":true,"update_time":"2022-06-20 13:00:09"},"47.105.153.104":{"severity":"high","judgments":["Zombie","IDC","Exploit","Spam"],"tags_classes":[{"tags":["Aliyun"],"tags_type":"public_info"}],"basic":{"carrier":"Alibaba Cloud","location":{"country":"China","province":"Shandong","city":"Qingdao City","lng":"120.372878","lat":"36.098733","country_code":"CN"}},"asn":{"rank":2,"info":"CNNIC-ALIBABA-CN-NET-AP Hangzhou Alibaba Advertising Co.,Ltd., CN","number":37963},"scene":"Hosting","confidence_level":"high","is_malicious":true,"update_time":"2022-06-27 21:11:32"}},"response_code":0,"verbose_msg":"OK"}

[ITWhisperer · Accepted solution]

| spath data
| spath input=data
| fields *.judgments{}

[zhenqi]

thanks for your help! the result is "37.0.10.15.judgments{}" and "47.105.153.104.judgments{}", what can I do if I want to stats the two judgments to one field?

[ITWhisperer]

Not sure what you mean by "stats the two judgments to one field, but you can combine them as a single multi-value field like this

| spath
| spath input=data
| fields *.judgments{}
| foreach *.judgments{}
    [| eval judgments=if(isnull(judgments),'<<FIELD>>',mvappend(judgments,'<<FIELD>>'))]

[zhenqi]

thanks ! I solved the problem by modifying json format,your answer helps me a lot