This topic describes the syntax and parameters of functions that parse JSON-formatted and XML-formatted data. This topic also provides examples on how to use the functions.
Functions
Type | Function | Description |
---|---|---|
JSON | json_select | Extracts or calculates a specific value from a JSON expression based on the JMESPath syntax. |
json_parse | Parses a specified value into a JSON object. | |
XML | xml_to_json | Converts XML-formatted data to JSON-formatted data and then expands the converted data. |
json_select
The json_select function is used to extract or calculate a specific value from a JSON expression based on the JMESPath syntax.
- Syntax
json_select(value, jmes, default=None, restrict=False)
- Parameters
Parameter Type Required Description value Arbitrary Yes The JSON expression or field from which a field is extracted. jmes String Yes The JMESPath expression that specifies the field that is extracted. default Arbitrary No If the field that you want to extract does not exist, the value of the default parameter is returned. Default value: None. restrict Boolean No Specifies whether the restricted mode is enabled if the value of the field that you want to extract is in an invalid JSON format. Default value: False. Valid values: - False: The invalid format issue is ignored and the system continues to transform the data. The value of the default parameter is returned.
- True: The invalid format issue is reported and the system stops transforming data. The log entry is dropped.
- Response
The extracted field value is returned.
- Examples
- Example 1: Extract the name field from the content field. The value of the name field
is returned.
- Raw log entry:
content: {"name": "xiaoming", "age": 10}
- Transformation rule:
e_set("json_filter",json_select(v("content"), "name"))
- Result:
content: {"name": "xiaoming", "age": 10} json_filter: xiaoming
- Raw log entry:
- Example 2: Extract the name field from the content field. All values in the name field
are returned.
- Raw log entry:
content: {"name": ["xiaoming", "xiaowang", "xiaoli"], "age": 10}
- Transformation rule:
e_set("json_filter",json_select(v("content"), "name[*]"))
- Result:
content: {"name": ["xiaoming", "xiaowang", "xiaoli"], "age": 10} json_filter: ["xiaoming", "xiaowang", "xiaoli"]
- Raw log entry:
- Example 3: Extract the value of the name3 field from the content field. If the name3
field does not exist, the value None is returned.
- Raw log entry:
content: {"name": "xiaoming", "age": 10}
- Transformation rule:
e_set("json_filter",json_select(v("content"), "name3", default="None"))
- Result:
content: {"name": "xiaoming", "age": 10} json_filter: None
- Raw log entry:
- Example 1: Extract the name field from the content field. The value of the name field
is returned.
json_parse
The json_parse function is used to parse a specified value into a JSON object.
- Syntax
json_parse(value, default=None, restrict=False)
- Parameters
Parameter Type Required Description value String Yes The field that you want to parse. default Arbitrary No If the field that you want to parse does not exist, the value of the default parameter is returned. Default value: None. restrict Boolean No Specifies whether the restricted mode is enabled if the value of the field that you want to extract is in an invalid JSON format. Default value: False. Valid values: - False: The invalid format issue is ignored and the system continues to transform the data. The value of the default parameter is returned.
- True: The invalid format issue is reported and the system stops transforming data. The log entry is dropped.
- Response
A JSON object is returned.
- Example
- Raw log entry:
content: {"abc": 123, "xyz": "test" }
- Transformation rule:
e_set("json",json_parse(v("content")))
- Result:
content: {"abc": 123, "xyz": "test" } json: {"abc": 123, "xyz": "test"}
- Raw log entry:
xml_to_json
The xml_to_json function is used to convert XML-formatted data to JSON-formatted data and then expand the converted data.
- Syntax
xml_to_json(source)
- Parameters
Parameter Type Required Description source String Yes The field that you want to convert. - Response
JSON-formatted data is returned.
- Example
- Raw log entry:
str : <data><country name="Liechtenstein"><rank>1</rank><year>2008</year><gdppc>141100</gdppc><neighbor name="Austria" direction="E"/><neighbor name="Switzerland" direction="W"/></country><country name="Singapore"><rank>4</rank><year>2011</year><gdppc>59900</gdppc><neighbor name="Malaysia" direction="N"/></country><country name="Panama"><rank>68</rank><year>2011</year><gdppc>13600</gdppc><neighbor name="Costa Rica" direction="W"/><neighbor name="Colombia" direction="E"/></country></data>
- Transformation rule:
e_set("str_json",xml_to_json(v("str")))
- Result:
str:<data><country name="Liechtenstein"><rank>1</rank><year>2008</year><gdppc>141100</gdppc><neighbor name="Austria" direction="E"/><neighbor name="Switzerland" direction="W"/></country><country name="Singapore"><rank>4</rank><year>2011</year><gdppc>59900</gdppc><neighbor name="Malaysia" direction="N"/></country><country name="Panama"><rank>68</rank><year>2011</year><gdppc>13600</gdppc><neighbor name="Costa Rica" direction="W"/><neighbor name="Colombia" direction="E"/></country></data>str_json:{"data": {"country": [{"@name": "Liechtenstein", "rank": "1", "year": "2008", "gdppc": "141100", "neighbor": [{"@name": "Austria", "@direction": "E"}, {"@name": "Switzerland", "@direction": "W"}]}, {"@name": "Singapore", "rank": "4", "year": "2011", "gdppc": "59900", "neighbor": {"@name": "Malaysia", "@direction": "N"}}, {"@name": "Panama", "rank": "68", "year": "2011", "gdppc": "13600", "neighbor": [{"@name": "Costa Rica", "@direction": "W"}, {"@name": "Colombia", "@direction": "E"}]}]}}
- Raw log entry: