i'm trying to extract data from json and show into my dashboard but failed
{
"timestamp":"2021-04-22T09:14:38.727Z",
"message":"Metrics: key1=false, [SystemMetricsBean] key2=key2val, [MetricAttributes] sumCountViaMetricsAnnotation=2, failureCount=0, sumDuration=46, minDuration=22, maxDuration=24, sumCountViaCacheAnnotation=2, numWithoutCache=2, numDisableCache=2",
"version":"1.1.0"
}
i'd like to extract failureCount and other statistic data then display in my dashboard
here is my search but not work:
base search
| spath path=message,output=metrics
| stats count(sumDuration) as duration, count(failureCount) as fail
can u help to guide me? also i try other cmd like extract, eval, rex but also not got the result
You are almost there - after the spath, copy the message field to _raw and run extract. The stats might be better as sums rather than counts, but it depends what it is that you are trying to get
| makeresults
| eval _raw="{
\"timestamp\":\"2021-04-22T09:14:38.727Z\",
\"message\":\"Metrics: key1=false, [SystemMetricsBean] key2=key2val, [MetricAttributes] sumCountViaMetricsAnnotation=2, failureCount=0, sumDuration=46, minDuration=22, maxDuration=24, sumCountViaCacheAnnotation=2, numWithoutCache=2, numDisableCache=2\",
\"version\":\"1.1.0\"
}"
| spath path=message,output=metrics
| eval _raw=metrics
| extract
| stats sum(sumDuration) as duration, sum(failureCount) as fail