Json field extraction rule not allowed?

Follow

mobile inrix

• February 25, 2015 18:53

Hi all,

My log body contains just valid json serialized string. I attempted to follow this instruction to set up json parser expression:

https://service.sumologic.com/help/Default.htm#JSON_Operator.htm?Highlight=JSON

like this:

parse "*" as jsonobject  | json field=jsonobject "transactionId"

but the rule validator keeps rejecting my parse expression.

Can sumo experts here help me understand what I have done wrong? Thanks.

2

• Official comment

  

  Peter Kwan

  • February 26, 2016 19:49

  Support for using the JSON and KV operators is upcoming in field extraction rule. Presently, it is not support and this is the reason the rule validator blocks that. We will keep you posted on our progress.

  Comment actions Permalink
• 

  Jeff Curto

  • February 26, 2016 19:44

  Same problem here too.

  0

  Comment actions Permalink
• 

  David Duke

  • August 01, 2018 15:58

  Update: August 1, 2016

  Field Extraction Rules now Support JSON and CSV. Field Extraction Rules (FERs) now support the JSON and CSV operators. (JSON auto and CSV auto) are not supported. For details, see Create a Field Extraction Rule. 

  0

  Comment actions Permalink

Please sign in to leave a comment.