Parsing- need help

Follow

Aakif Shaikh

• May 15, 2019 16:15

I want to parse the below JSON logs to see the value for field LoadBalancerName and DNSName. I tried the below logic and it works but what if there are more than 5 values of LoadBalancerName in same array. How do I separate that? Please advise.

| json "[0].LoadBalancerName", "[1].LoadBalancerName" as lbn1, lbn2 nodrop

0

• Official comment

  

  Graham Watts

  • May 15, 2019 23:22

  Hey Aakif,
  
  Parse regex multi will allow you to parse out as many values for LoadBalancerName as there are in each log:
  
  https://help.sumologic.com/05Search/Search-Query-Language/01-Parse-Operators/02-Parse-Variable-Patterns-Using-Regex#Parse_multi
  
  Let us know if this answers your question here, happy to assist!

  Comment actions Permalink
• 

  Aakif Shaikh

  • May 17, 2019 21:59

  Description": "launch-lizard-101 created 2018",

  Description": "timing",

  Description": "testing-sg",

  regex:

  | parse regex "(?<Description>\:\s((?:").*(?:"))\W)" multi

  does not seems to work- please help

  Goal: is to parse the multiple description field exists in each log

  0

  Comment actions Permalink

Please sign in to leave a comment.