fromjson
Use the fromjson operator to extract the top level keys from the JSON object and create a table with keys as column names and values as field values.
Syntax
|fromjson <json_field> [prefix=<string>]
<json_field>
|
Specify a field that contains a JSON object. |
[prefix=<string>]
|
Optional. Specify a prefix to append to extracted column names. |
Usage
You can use the fromjson operator to extract fields from a JSON field. The top level keys are extracted.
Use the optional prefix argument when you want to append the custom string to the column names. In your AQL query syntax, you must specify the JSON field argument before the optional prefix argument.
Examples
Example 1: Parse JSON field and extract nested data.
|<a query that generates a json_field> |fromjson <json_field> prefix="extr_"Example 2: Convert JSON string to structured fields.
|test_table_fromjson| fromjson json_field1 prefix="foo_"Example 3: Takes the last 10 OCSF events, packages class_name and metadata.product.name into a JSON object, then parses it back out into individual fields.
ocsf | tail 10 | fields class_name, metadata.product.name | makejson class_name, metadata.product.name output=new_field | fromjson new_field