Parsing Heterogeneous JSON Streams

Comments

1 comment

  • Avatar
    Latimer Luis

    I think what you'll need is to use the 'nodrop' operator at the end of your last json parsing statement to ensure that you're not dropping logs that don't contain this key. Without this nodrop clause, our parsers act as another way to filter data. 

    _sourceName=source1 or _sourceName=source2
    | json auto
    | where _m = "XYZ completed" or _m = "received message"
    | json field=_raw "received.key" nodrop
    | if(%"received.key"="XYZ",1,0) as count_received
    | if(_m="XYZ completed",1,0) as count_completed
    | sum(count_received) as count_received, sum(count_completed) as count_completed

    Something like the above might work. 

Please sign in to leave a comment.