I have events that will be indexed that will look like the below:
2019-06-06 21:12:40.397 { "response": "NodeJST5109TIJPMCACS0700099901DIGITALFUSANodeJST5109ACEQ1TU1", "elapsedTime": 347 }
I would like to extract the elapsedTime field where it is greater than 5000
I cannot seem to get spath to auto_extract the fields so that I can get the events ...where elapsedTime > 5000
This should be straightforward, but I cannot get it to work...any help will be appreciated
@riotto
Your events having a mixture of text & JSON. SO we have to extract a field from that JSON part. Can you please try this?
YOUR_SEARCH | rex field=_raw "(?<json_data>\{.+\})"
| eval _raw=json_data
| kv | where elapsedTime > 5000 | table elapsedTime
My Sample Search:
| makeresults
| eval _raw="2019-06-06 21:12:40.397 { \"response\": \"NodeJST5109TIJPMCACS0700099901DIGITALFUSANodeJST5109ACEQ1TU1\", \"elapsedTime\": 347 }"
| append [ | makeresults | eval _raw="2019-06-06 21:12:40.397 { \"response\": \"NodeJST5109TIJPMCACS0700099901DIGITALFUSANodeJST5109ACEQ1TU1\", \"elapsedTime\": 5347 }" ]
| rex field=_raw "(?<json_data>\{.+\})"
| eval _raw=json_data
| kv | where elapsedTime > 5000 | table elapsedTime
Thanks
The spath
command works on an input field, _raw
by default. You'll need to have your JSON object extracted to a field you can reference via spath input=<fieldname>
.
Alternatively, if you have access to the application change the log format to be something friendlier.
Do you have an example I can try for the above event? I can't seem to get something right on it...