This might not answer your question, but I had a similar problem getting spath to work with an array of objects. For foo=[{"bar":1},{"bar":2},{"bar":3}] , I did not even get a multivalued field named '{}' when using: | spath input=foo
I got spath to work by changing my log format and wrapping the JSON array in an object:
foo={"foo":[{"bar":1},{"bar":2},{"bar":3}]}
I was then able to use the following:
| spath input=foo output=bar path=foo{}.bar
Without altering the log, I was able to use:
| eval foo="{\"foo\":" + foo + "}" | spath input=foo output=bar path=foo{}.bar
... View more