How to use JSON subfields with the eval command?

[gzak]

My log entries consist of a single json object, like so:

{ Severity: "INFO", Message: { StatusCode: 200, Route: "/hello/world?x=1" } }
{ Severity: "WARN", Message: { StatusCode: 500, Route: "/hello/world?x=2" } }

Just as a test, I'm able to create the following panel in my dashboard:

index="my_index" | bucket span=10m _time | stats count(eval(Severity="WARN")) as warning by Message.Route, _time

This appears to work fine since the Severity property is at the root of the json object. However, if I switch to one of the subproperties of the object, it doesn't find any records:

index="my_index" | bucket span=10m _time | stats count(eval(Message.StatusCode="500")) as warning by Message.Route, _time

I should also point out that if I don't wrap the "500" in quotes, it gives me a typechecking error saying that the '==' operator is being applied to two different types of arguments (which doesn't make any sense, and might be contributing to this issue).

Please advise on how I can procede. This shouldn't be so difficult...

[somesoni2 · Accepted solution]

Field names which contains special characters like spaces OR dot (.), should be enclosed within single quotes when referring in eval OR where command's expressions. So your second query should work with following syntax

 index="my_index" | bucket span=10m _time | stats count(eval('Message.StatusCode'="500")) as warning by Message.Route, _time

[gzak]

I could have sworn I tried all sorts of combinations of single quotes yesterday before coming here, but today it worked on my first try. Anwyay, this is definitely the solution.