Parsing nested JSON blobs

Comments

1 comment

  • Avatar
    Kevin

    The json operator uses a subset of the JSON path format. More information on that here. http://goessner.net/articles/JsonPath/

    Given your sample the following operation should actually work and return an array of IDs.

    | json "details[*].id"
    

    You might also try the following, which should also work.

    | json "details..id"
    

    You would then need to subparse the returned array using the "multi" option of a parse regex.

    | json "details..id" as detail_id
    | parse regex field=detail_id "\"(?<detail_id>.*?)\"" multi
    

    Then you can add your count on the detail IDs.

    | json "details..id" as detail_id
    | parse regex field=detail_id "\"(?<detail_id>.*?)\"" multi
    | count by detail_id
    
    1
    Comment actions Permalink

Please sign in to leave a comment.