json parsing

[onthakur]

Hi

I have logs in below format, which is mix of delimiter (|) and json. now I want to extract statuscode and statuscodevalue and create table with columns _time,statuscodevalue,statuscode.

can someone please help me ?

2021-11-22 05:52:09.755 INFO - c.t.c.a.t.service.UserInfoService(101) - abcd | abcd-APP | /user-info | af4772c0-1fcd-4a82-858e-c2f7f0821724 | APP |
-| Response of validateAddress abcd Service: {
"headers" : { },
"body" : {
"baseError" : {
"code" : "3033",
"reason" : "User is unauthorized",
"explanation" : "Unauthorized"
}
},
"statusCode" : "UNAUTHORIZED",
"statusCodeValue" : 401
}

[ITWhisperer]

| makeresults
| eval _raw="2021-11-22 05:52:09.755 INFO - c.t.c.a.t.service.UserInfoService(101) - abcd | abcd-APP | /user-info | af4772c0-1fcd-4a82-858e-c2f7f0821724 | APP |
-| Response of validateAddress abcd Service: {
\"headers\" : { },
\"body\" : {
\"baseError\" : {
\"code\" : \"3033\",
\"reason\" : \"User is unauthorized\",
\"explanation\" : \"Unauthorized\"
}
},
\"statusCode\" : \"UNAUTHORIZED\",
\"statusCodeValue\" : 401
}"



| eval _time=strptime(_raw,"%F %T.%Q")
| rex "(?ms)Service: (?<response>.*)"
| spath input=response statusCode
| spath input=response statusCodeValue
| table _time statusCodeValue statusCode