Hi, you could use something like spath to process the json and then pick the logs array out of the resultant object. Maybe something like this: |makeresults | eval json="{\"name\":\"json_name\", \"logs\":[{\"name\":\"log1\"}, { \"name\":\"log2\"}]}", output_log_array=spath(json,"logs{}"), output_log_names=spath(json,"logs{}.name") I added a second example with output_log_names to show how you would extract particular fields within the array json into their own multivalued field.
... View more