I have created a query similar to the below
host=nftHost index=paymeNow source="\\\\epamjhost\Logs\*"
| rex "(Message content+\s+:+\s+|\[Handling message+\s+:+\s+|\[Handling command of type CheckCommand:+\s+)(?<json>\{.*)"
| spath input=json | table _time, MessageTypeDesc, CurrentState, CaseId, TaskType, Attributes{}.AttributeName, Attributes{}.JsonValue, _raw
The below json is obtained from the rex expression and spath is used to parse it.
{ "TaskId" : "1", "CurrentState" : "COMPLETED", "RequestedAction" : null, "User" : "NFTPAYME", "Attributes" : [{ "AttributeName" : "transactionId", "AttributeType" : "int", "JsonValue" : "4" }, { "AttributeName" : "Enabled", "AttributeType" : "boolean", "JsonValue" : "false" }, { "AttributeName" : "holdType", "AttributeType" : "string", "JsonValue" : "" }, { "AttributeName" : "isSettlement", "AttributeType" : "boolean", "JsonValue" : "false" }, { "AttributeName" : "isIntraday", "AttributeType" : "boolean", "JsonValue" : "false" }, { "AttributeName" : "isReleaseReady", "AttributeType" : "boolean", "JsonValue" : "false" }, { "AttributeName" : "isStat", "AttributeType" : "boolean", "JsonValue" : "false" }, { "AttributeName" : "StatusList", "AttributeType" : "string", "JsonValue" : "" }, ], "TaskType" : "Settle", "CaseId" : "1", }
Attributes contains an array of objects so my question is how to take the attributes and create a single string from the whole array?
_time
MessageTypeDesc
CurrentState
CaseId
TaskType
Attributes
_raw
transactionId:4 Enabled:true
holdType:
isSettlement:false
... View more
