Is it possible to use fields as variables in the query language? Specifically in parsing JSON in this case?
Here is an example, let's say the full key name is not always obvious and needs to be extracted to be used later based on what it contains:
| parse regex "(?<found_key>\"[^\"]*key_contains_this_string\")"
| replace (found_value, "\"", "") as cleaned_up_key <-----sanitizing the key
| json "$['some_object']['cleaned_up_key]" as my_json_object
This example doesn't work, because it's using the string "cleaned_up_key" instead of the value that is stored in the cleaned_up_key field. Is there any way to use a variable in this way?
Or alternatively, a wildcard like follows? (I've confirmed this doesn't work, the wildcard seems to be all or nothing.)
| json "$['some_object'][*key_contains_this_string]" as my_json_object
Please sign in to leave a comment.