My logs have a JSON field, like this:
{
"foo": 5,
"bar": {}
}
I'd like to filter out logs that have an empty JSON for the "bar" field, like in the above example.
How do I do that? I tried something like
where len('bar{}') > 0
but didn't work.
Thank you so much
Note bar is not an array, therefore bar{} does not exist. In that sample data, bar is null. So, to exclude them,
| where isnotnull(bar)
Try this.
| where isnotnull("bar.*")