My data is something like this:
stackTrace: [
{
inProject: false,
file: "/path/to/file.c"
},
{
inProject: true,
file: "/path/to/file.c"
},
{
inProject: false,
file: "/path/to/file.c"
}
]
I'd like to get the list of events where the first element that has inProject=true contains "file.c" in file.
Well, the wording here is a little tricky because if reading your request literarily, something like this:
stackTrace: [ { inProject: true, file: "/path/to/otherfile.c" }, { inProject: true, file: "/path/to/file.c" } ]
Should not match. (Bonus question about the filename matching but i suppose you want the literal "file.c" as whole filename, so the "otherfile.c" is something you don't want. Otherwise of course you can adjust the example accordingly.
If your data is indexed and parsed correctly (as valid json element), something like this should work.
Your current search which includes field with name stackTrace{}.inProject and stackTrace{}.file
| where mvindex('stackTrace{}.inProject',0)="false" AND like('stackTrace{}.inProject',"%file.c")
| spath stackTrace{} output=stackTrace
| mvexpand stackTrace
| spath input=stackTrace
| where inProject="true" AND match(file,"file\.c")