Parsing Heterogeneous JSON Streams


1 comment

  • Avatar
    Latimer Luis

    I think what you'll need is to use the 'nodrop' operator at the end of your last json parsing statement to ensure that you're not dropping logs that don't contain this key. Without this nodrop clause, our parsers act as another way to filter data. 

    _sourceName=source1 or _sourceName=source2
    | json auto
    | where _m = "XYZ completed" or _m = "received message"
    | json field=_raw "received.key" nodrop
    | if(%"received.key"="XYZ",1,0) as count_received
    | if(_m="XYZ completed",1,0) as count_completed
    | sum(count_received) as count_received, sum(count_completed) as count_completed

    Something like the above might work. 

    Comment actions Permalink

Please sign in to leave a comment.