JSON Field Extractor Filters

George Alpizar
George Alpizar
  • Updated

Overview

This filter type extracts a field's value and replaces the whole JSON content with the field's value.

When this filter is applied, the original JSON content is discarded. As a result, if the original JSON needs to be fed into another workflow or processor, then we recommend that you attach this filter to the processor.

Review Parameters

Review the following parameters that you can configure in the Edge Delta App:

YAML Description
name

Enter a descriptive name for this filter.

When you create a workflow, you will use this label to enter your filter into the workflow.

This parameter is required. 

Review the following example: 

name: extract_severity
type

Select (or enter) extract-json-field.

This parameter is required. 

Review the following example: 

type: extract-json-field
field_path

This parameter is a dot-separated path of the field, such as log.message.

This value will be extracted, and then the original JSON content / fields will be removed and not processed.

This parameter is optional. 

Review the following example: 

field_path: "severity"

Review Sample Configuration 

Review the following sample configuration: 

filters:
  - name: extract_severity
    type: extract-json-field
    field_path: "severity"
  - name: extract_first_data
    type: extract-json-field
    field_path: "records[0].data"
  - name: extract_all_data
    type: extract-json-field
    field_path: "records[*].data"

Note

If you add a filter into an input definition, the the filter becomes a source-level filter.

Additionally, the following example extracts the message field.

  • If the field was nested, then you would set field_path to its path.
- name: extract_message 
  type: extract-json-field 
  field_path: "message"

For the following sample log:

{"timestamp":1623793757, "level": "info", "message": "hello world"}

After the extractor filter is applied, you will see: 

hello world

 

Share this document