Multivalue Extraction

[cquinney]

I have the following set of data within each event:

stack_trace: [ [-]
{ [-]
class_name: FOO
file_name: BAR
line_number: -2
method_name: WALK
}
{ [-]
class_name: FOO2
file_name: BAR2
line_number: 1356
method_name: JUMP
}
{ [-]
class_name: FOO
file_name: BAR
line_number: 808
method_name: SKIP
}
]

I want to extract only the first method_name within the stack (| spath "stack_trace{}.method_name" | search "stack_trace{}.method_name"=WALK), which can change from event to event. I've tried using mvindex but I'm having no success. Any suggestions would be greatly appreciated.

[to4kawa]

| makeresults
| eval _raw="{\"stack_trace\":[{\"class_name\":\"FOO\",\"file_name\":\"BAR\",\"line_number\":\"-2\",\"method_name\":\"WALK\"},{\"class_name\":\"FOO2\",\"file_name\":\"BAR2\",\"line_number\":\"1356\",\"method_name\":\"JUMP\"},{\"class_name\":\"FOO\",\"file_name\":\"BAR\",\"line_number\":\"808\",\"method_name\":\"SKIP\"}]}"
| rex "method_name.*?(?<method_name>\w+)"

If you want only first method_name, try rex . Regex works by order.

[dmarling]

Using mvindex will work for you use case, but you will need to wrap the field name in single quotes since there are special characters in the field name that mean concatenation when using where or eval: . Using this eval will get the first method_name in the stack: | eval first_method_name=mvindex('stack_trace{}.method_name', 0) Here's a run anywhere example using your own data to demonstrate it:

| makeresults count=1
| eval data="{\"stack_trace\":[{\"class_name\":\"FOO\",\"file_name\":\"BAR\",\"line_number\":\"-2\",\"method_name\":\"WALK\"},{\"class_name\":\"FOO2\",\"file_name\":\"BAR2\",\"line_number\":\"1356\",\"method_name\":\"JUMP\"},{\"class_name\":\"FOO\",\"file_name\":\"BAR\",\"line_number\":\"808\",\"method_name\":\"SKIP\"}]}"
| spath input=data
| eval first_method_name=mvindex('stack_trace{}.method_name', 0)

[cquinney]

Thank you! The eval works great, I was using double quotes instead of single, great catch!

[dmarling]

I'm glad I could help you! Please make sure to also accept the answer. Thank you!