JSON: Filter on nested property

Follow

Vitaliy Kryvosheiev

• April 14, 2020 15:47
• Edited

Hello,

I have log messages containing followign JSON

{
  "Properties": {
    "Source": "string"
  }
}

 

How to filter on *Property.Source* ? I'm trying to apply something like

where Properties.Source != "Source1" 

 

0

• 

  Rick Jury

  • April 16, 2020 00:13

  Hi Vitaliy,

   

  here are two ways you could do this:

  1. parse the whole key out

  // = string

  | "{ \"Properties\": { \"Source\": \"string\" }}" as some_json
  // != string
  | "{ \"Properties\": { \"Source\": \"another text\" }}" as some_json
  //| json auto field = some_json
  | json field=some_json "Properties.Source"
  | where !(%"properties.source" = "string")
  
  2. alias the key to type less later

  // = string
  | "{ \"Properties\": { \"Source\": \"string\" }}" as some_json
  // != string
  | "{ \"Properties\": { \"Source\": \"another text\" }}" as some_json
  //| json auto field = some_json
  | json field=some_json "Properties.Source" as source
  | where !(source = "string")

  0

  Comment actions Permalink

Please sign in to leave a comment.