JSON: Filter on nested property

Comments

1 comment

  • Avatar
    Rick Jury

    Hi Vitaliy,

     

    here are two ways you could do this:

    1. parse the whole key out

    // = string

    | "{ \"Properties\": { \"Source\": \"string\" }}" as some_json
    // != string
    | "{ \"Properties\": { \"Source\": \"another text\" }}" as some_json
    //| json auto field = some_json
    | json field=some_json "Properties.Source"
    | where !(%"properties.source" = "string")

    2. alias the key to type less later

    // = string
    | "{ \"Properties\": { \"Source\": \"string\" }}" as some_json
    // != string
    | "{ \"Properties\": { \"Source\": \"another text\" }}" as some_json
    //| json auto field = some_json
    | json field=some_json "Properties.Source" as source
    | where !(source = "string")

    0
    Comment actions Permalink

Please sign in to leave a comment.