Thank you for all the inputs. Here is the final query
index=Github_Webhook source="http:github-dev-token" eventtype="GitHub::Push" sourcetype="json_ae_git-webhook"
| rename repository.name as RepoName
| spath path=commits{} output=commitscollection
| mvexpand commitscollection
| fields _time RepoName commitscollection
| spath input=commitscollection
| table RepoName id added{} modified{} removed{} author.name author.email message
| spath path=commits{} output=commitscollection --> Thanks to all the responders. This helps in getting the commits from array
Next challenge is, if you pull the data for all the other fields in the same approach, each of those values cannot be mapped with each other. To address this, we should use mvexpand to split them into separate array events
Once the array is split into separate events, now, we will use the same logic to split the data into events.
Hope this helps.
... View more
