How to query and extract value fra Json array

[thoj]

Having the json data/array below, how do I create a new (single value) field with only the TargetVersion that has IsPreferred = true

"TargetVersions": [
{
"IsPreferred": false
...
},
{
"IsPreferred": true
...
]

[renjith_nair]

@thoj,

Assuming you have some other value for e.g. version inside your json structure, you could use spath to extract from json array.

Something similar to below (added version as a value),

|makeresults|eval json="{\"TargetVersions\": [
{
\"IsPreferred\": false,
\"Version\" : \"1.0\"
},
{
\"IsPreferred\": true,
\"Version\" : \"2.0\"
]
}"|spath input=json|fields - json,_time
|rename "TargetVersions{}.IsPreferred" as IsPreferred,"TargetVersions{}.Version" as Version
|eval zipped=mvzip(IsPreferred,Version)|fields zipped|mvexpand zipped|makemv delim="," zipped
|eval IsPreferred=mvindex(zipped,0),Version=mvindex(zipped,1)|fields - zipped|where IsPreferred="true"