Overview
This filter type extracts a field's value and replaces the whole JSON content with the field's value.
When this filter is applied, the original JSON content is discarded. As a result, if the original JSON needs to be fed into another workflow or processor, then Edge Delta recommends that you attach this filter to the processor.
- To learn more, see Processors Overview.
Review Parameters
Review the following parameters that you can configure in the Edge Delta App:
Visual Editor | YAML | Description |
Name | name |
Enter a descriptive name for this filter. When you create a workflow, you will use this label to enter your filter into the workflow. This parameter is required. Review the following example: name: extract_severity |
Type | type |
Select (or enter) extract-json-field. This parameter is required. Review the following example: type: extract-json-field |
JSON Field Path | field_path |
This parameter is a dot-separated path of the field, such as log.message. This value will be extracted, and then the original JSON content / fields will be removed and not processed. This parameter is optional. Review the following example: field_path: "severity" |
Review Sample Configuration
Review the following sample configuration:
filters:
- name: extract_severity
type: extract-json-field
field_path: "severity"
- name: extract_first_data
type: extract-json-field
field_path: "records[0].data"
- name: extract_all_data
type: extract-json-field
field_path: "records[*].data"
Note
Additionally, the following example extracts the message field.
- If the field was nested, then you would set field_path to its path.
- name: extract_message
type: extract-json-field
field_path: "message"
For the following sample log:
{"timestamp":1623793757, "level": "info", "message": "hello world"}
After the extractor filter is applied, you will see:
hello world