JSON: Filter on nested property
Hello,
I have log messages containing followign JSON
{
"Properties": {
"Source": "string"
}
}
How to filter on *Property.Source* ? I'm trying to apply something like
where Properties.Source != "Source1"
-
Hi Vitaliy,
here are two ways you could do this:
1. parse the whole key out
// = string
| "{ \"Properties\": { \"Source\": \"string\" }}" as some_json
// != string
| "{ \"Properties\": { \"Source\": \"another text\" }}" as some_json
//| json auto field = some_json
| json field=some_json "Properties.Source"
| where !(%"properties.source" = "string")
2. alias the key to type less later// = string
| "{ \"Properties\": { \"Source\": \"string\" }}" as some_json
// != string
| "{ \"Properties\": { \"Source\": \"another text\" }}" as some_json
//| json auto field = some_json
| json field=some_json "Properties.Source" as source
| where !(source = "string")
Please sign in to leave a comment.
Comments
1 comment