Skip to content

Latest commit

 

History

History
170 lines (132 loc) · 5.36 KB

json_array_parser.md

File metadata and controls

170 lines (132 loc) · 5.36 KB

json_array_parser operator

The json_array_parser operator parses the string-type field selected by parse_from assumed to be of a json array format into a list. A JArray string (or a json array string) is a string that represents a JSON array. A JSON array is a type of data structure that is used to store data in a structured way. It consists of an ordered list of values that can be either strings, numbers, objects, or even other arrays.

Examples:

a simple json array string with strictly strings in it:

"[\"Foo\", \"Bar\", \"Charlie\"]"

json array after parsing:

["Foo", "Bar", "Charlie"]

a more complex json array string with different types in it without nested objects:

"[\"Hello\", 42, true, null]"

json array after parsing:

["Hello", 42, true, null]

a more complex json array string with different types in it with nested objects:

"[\"Hello\", 42, {\"name\": \"Alice\", \"age\": 25}, [1, 2, 3], true, null]"

json array after parsing:

["Hello", 42, {"name": "Alice", "age": 25}, [1, 2, 3], true, null]

Notice that for this example, the current parser will parse every nested object as a string and so the result is actually this -

["Hello", 42, "{\"name\": \"Alice\", \"age\": 25}", "[1, 2, 3]", true, null]

More information on json arrays can be found here

Configuration Fields

Field Default Description
id json_array_parser A unique identifier for the operator.
output Next in pipeline The connected operator(s) that will receive all outbound entries.
header optional A string of comma delimited field names. When a header is set, the output will be a map containing the header fields as keys and the parsed input json array fields as matching values
parse_from body The field from which the value will be parsed.
parse_to required. can be one of body or a nested field inside body, attributes or resource (ie attributes.parsed). When a header is used, attributes is also valid The field to which the value will be parsed.
on_error send The behavior of the operator if it encounters an error. See on_error.
timestamp nil An optional timestamp block which will parse a timestamp field before passing the entry to the output operator.
severity nil An optional severity block which will parse a severity field before passing the entry to the output operator.

Embedded Operations

The json_array_parser can be configured to embed certain operations such as timestamp and severity parsing. For more information, see complex parsers.

Example Configurations

Parse the field body with a json array parser into an attributes field

Configuration:

- type: json_array_parser
  parse_from: body
  parse_to: attributes.output
Input Entry Output Entry 
{
  "body": "[1,\"debug\",\"Debug Message\", true]"
}
 
{
  "attributes": {
    "output": [1, "debug", "Debug Message", true]
  }
}

Parse the field body with a json array parser

Configuration:

- type: json_array_parser
  parse_to: body
Input Entry Output Entry 
{
  "body": "[1,\"debug\",\"Debug Message\", true]"
}
 
{
  "body": [1, "debug", "Debug Message", true]
}

Parse the field body with a json array parser and a header into attributes

Configuration:

- type: json_array_parser
  parse_to: attributes
  header: origin,sev,message,isBool
Input Entry Output Entry 
{
  "body": "[1,\"debug\",\"Debug Message\", true]"
}
 
{
  "body": "[1,\"debug\",\"Debug Message\", true]",
  "attributes": {
    "origin":  1,
    "sev":     "debug",
    "message": "Debug Message",
    "isBool":  true,
  }
}