I'm trying to parse message. I think issue is around array, because this way used to work with json that included only strings. My @message that looks like:
@message
2023-12-12 08:50:52.063 WARN 1 --- [nerContainer-22] d.k.d.a.s.i.ImportTrackingDataService : {"uuid":"4226ed94-c64a-473a-830e-3ca54d9d3740","supplier":"test","missingOrderIds":["112qe292113"]}
I'm trying to parse it:
filter @message like 'missingOrderIds'
| parse '{"uuid":"*",supplier:"*",missingOrderIds":["*"]}' as uuid, supplier, missingOrderIds
| sort @timestamp desc
| limit 20