We are ingesting JSON data similar to the following:
{
"Id":"987654321",
"data":[
{
"answer":"12345",
"label":"Work Order"
},
{
"answer":"04/01/2018",
"label":"Work Order Date"
},
{
"answer":"15:17:00",
"label":"Order Time"
},
.
. (more answer/label elements)
.
],
"username":"some.user"
}
Entirely possible we're missing it in the spath and related JSON processing documentation, but we're unable to determine how to format a search query which allows use of the "label" value as the left-hand side and the "answer" value as the right-hand side of a query (e.g., "Work Order Date"="04/01/2018").
The JSON array contains additional answer/label pairs with other date values, so specifying something like 'data{}.answer="04/01/2018"' is insufficient, as it matches any event where that date appears as any 'answer' value.
Any suggestions?
... View more