This topic describes the syntax and parameters of functions that parse JSON-formatted and XML-formatted data. This topic also provides examples on how to use the functions.

Functions

Type Function Description
JSON json_select Extracts or calculates a specific value from a JSON expression based on the JMESPath syntax.
json_parse Parses a specified value into a JSON object.
XML xml_to_json Converts XML-formatted data to JSON-formatted data and then expands the converted data.

json_select

The json_select function is used to extract or calculate a specific value from a JSON expression based on the JMESPath syntax.

  • Syntax 
    json_select(value, jmes, default=None, restrict=False)
  • Parameters
    Parameter Type Required Description
    value Arbitrary Yes The JSON expression or field from which a field is extracted.
    jmes String Yes The JMESPath expression that specifies the field that is extracted.
    default Arbitrary No If the field that you want to extract does not exist, the value of the default parameter is returned. Default value: None.
    restrict Boolean No Specifies whether the restricted mode is enabled if the value of the field that you want to extract is in an invalid JSON format. Default value: False. Valid values:
    • False: The invalid format issue is ignored and the system continues to transform the data. The value of the default parameter is returned.
    • True: The invalid format issue is reported and the system stops transforming data. The log entry is dropped.
  • Response

    The extracted field value is returned.

  • Examples
    • Example 1: Extract the name field from the content field. The value of the name field is returned.
      • Raw log entry: 
        content:  {"name": "xiaoming", "age": 10}
      • Transformation rule: 
        e_set("json_filter",json_select(v("content"), "name"))
      • Result:
        content:  {"name": "xiaoming", "age": 10}
json_filter:  xiaoming
    • Example 2: Extract the name field from the content field. All values in the name field are returned.
      • Raw log entry: 
        content:  {"name": ["xiaoming", "xiaowang", "xiaoli"], "age": 10}
      • Transformation rule:
        e_set("json_filter",json_select(v("content"), "name[*]"))
      • Result: 
        content:  {"name": ["xiaoming", "xiaowang", "xiaoli"], "age": 10}
json_filter:  ["xiaoming", "xiaowang", "xiaoli"]
    • Example 3: Extract the value of the name3 field from the content field. If the name3 field does not exist, the value None is returned.
      • Raw log entry: 
        content:  {"name": "xiaoming", "age": 10}
      • Transformation rule: 
        e_set("json_filter",json_select(v("content"), "name3", default="None"))
      • Result: 
        content:  {"name": "xiaoming", "age": 10}
json_filter: None

json_parse

The json_parse function is used to parse a specified value into a JSON object.

  • Syntax 
    json_parse(value, default=None, restrict=False)
  • Parameters
    Parameter Type Required Description
    value String Yes The field that you want to parse.
    default Arbitrary No If the field that you want to parse does not exist, the value of the default parameter is returned. Default value: None.
    restrict Boolean No Specifies whether the restricted mode is enabled if the value of the field that you want to extract is in an invalid JSON format. Default value: False. Valid values:
    • False: The invalid format issue is ignored and the system continues to transform the data. The value of the default parameter is returned.
    • True: The invalid format issue is reported and the system stops transforming data. The log entry is dropped.
  • Response

    A JSON object is returned.

  • Example
    • Raw log entry: 
      content:  {"abc": 123, "xyz": "test" }
    • Transformation rule: 
      e_set("json",json_parse(v("content")))
    • Result:
      content:  {"abc": 123, "xyz": "test" }
json:  {"abc": 123, "xyz": "test"}

xml_to_json

The xml_to_json function is used to convert XML-formatted data to JSON-formatted data and then expand the converted data.

  • Syntax 
    xml_to_json(source)
  • Parameters
    Parameter Type Required Description
    source String Yes The field that you want to convert.
  • Response

    JSON-formatted data is returned.

  • Example
    • Raw log entry: 
      str : <data><country name="Liechtenstein"><rank>1</rank><year>2008</year><gdppc>141100</gdppc><neighbor name="Austria" direction="E"/><neighbor name="Switzerland" direction="W"/></country><country name="Singapore"><rank>4</rank><year>2011</year><gdppc>59900</gdppc><neighbor name="Malaysia" direction="N"/></country><country name="Panama"><rank>68</rank><year>2011</year><gdppc>13600</gdppc><neighbor name="Costa Rica" direction="W"/><neighbor name="Colombia" direction="E"/></country></data>
    • Transformation rule: 
      e_set("str_json",xml_to_json(v("str")))
    • Result: 
      str:<data><country name="Liechtenstein"><rank>1</rank><year>2008</year><gdppc>141100</gdppc><neighbor name="Austria" direction="E"/><neighbor name="Switzerland" direction="W"/></country><country name="Singapore"><rank>4</rank><year>2011</year><gdppc>59900</gdppc><neighbor name="Malaysia" direction="N"/></country><country name="Panama"><rank>68</rank><year>2011</year><gdppc>13600</gdppc><neighbor name="Costa Rica" direction="W"/><neighbor name="Colombia" direction="E"/></country></data>str_json:{"data": {"country": [{"@name": "Liechtenstein", "rank": "1", "year": "2008", "gdppc": "141100", "neighbor": [{"@name": "Austria", "@direction": "E"}, {"@name": "Switzerland", "@direction": "W"}]}, {"@name": "Singapore", "rank": "4", "year": "2011", "gdppc": "59900", "neighbor": {"@name": "Malaysia", "@direction": "N"}}, {"@name": "Panama", "rank": "68", "year": "2011", "gdppc": "13600", "neighbor": [{"@name": "Costa Rica", "@direction": "W"}, {"@name": "Colombia", "@direction": "E"}]}]}}