Aws cloud insight parsing json with array

17 views Asked by At

I'm trying to parse message. I think issue is around array, because this way used to work with json that included only strings. My @message that looks like:

@message    
2023-12-12 08:50:52.063  WARN 1 --- [nerContainer-22] d.k.d.a.s.i.ImportTrackingDataService    : {"uuid":"4226ed94-c64a-473a-830e-3ca54d9d3740","supplier":"test","missingOrderIds":["112qe292113"]}

I'm trying to parse it:

filter @message like 'missingOrderIds'
| parse '{"uuid":"*",supplier:"*",missingOrderIds":["*"]}' as uuid, supplier, missingOrderIds
| sort @timestamp desc
| limit 20

The result looks like: enter image description here

0

There are 0 answers