Structured data functions

Extracts or calculates values from a JSON expression using JMESPath syntax.

• Syntax

  json_select(value, jmes, default=None, restrict=False)

• Parameters

  Parameter	Type	Required	Description
  value	String, JSON	Yes	The JSON expression or field to extract from.
  jmes	String	Yes	The JMESPath expression that specifies the field to extract.
  default	String	No	The fallback value if the specified field does not exist. Default: None (no value returned).
  restrict	Bool	No	Whether to enable restricted mode when the extracted value is not valid JSON. Default: False. False: Ignores the error and continues transformation. Returns the default value. True: Reports an error, stops transformation, and discards the log.

• Response

  The extracted value.

• Examples

  • Example 1: Extract the value of the name element from the content field.

    • Raw log

      content:  {"name": "xiaoming", "age": 10}

    • Transformation rule

      e_set("json_filter",json_select(v("content"), "name"))

    • Result

      content:  {"name": "xiaoming", "age": 10}
      json_filter:  xiaoming

  • Example 2: Extract all values of the name element from the content field.

    • Raw log

      content:  {"name": ["xiaoming", "xiaowang", "xiaoli"], "age": 10}

    • Transformation rule

      e_set("json_filter", json_select(v("content"), "name[*]"))

    • Result

      content:  {"name": ["xiaoming", "xiaowang", "xiaoli"], "age": 10}
      json_filter:  ["xiaoming", "xiaowang", "xiaoli"]

  • Example 3: Extract the name3 element. If it does not exist, return the default value.

    • Raw log

      content:  {"name": "xiaoming", "age": 10}

    • Transformation rule

      e_set("json_filter", json_select(v("content"), "name3", default="None"))

    • Result

      content:  {"name": "xiaoming", "age": 10}
      json_filter: None

  • Example 4: Extract the name-test element (contains a hyphen) from the content field.

    • Raw log

      content:  {"name": {"name-test":"xiaoming"}, "age": 10}

    • Transformation rule

      e_set("json_filter", json_select(v("content"), 'name."name-test"', default=None))

    • Result

      content:  {"name": {"name-test":"xiaoming"}, "age": 10}
      json_filter: xiaoming

  • Example 5: Extract the name-test element (contains a hyphen). If it does not exist, no field is returned.

    • Raw log

      content:  {"name": {"name.test":"xiaoming"}, "age": 10}

    • Transformation rule

      e_set("json_filter", json_select(v("content"), 'name."name-test"', default=None))

    • Result

      content:  {"name": {"name-test":"xiaoming"}, "age": 10}

Parses a value into a JSON object.

• Syntax

  json_parse(value, default=None, restrict=False)

• Parameters

  Parameter	Type	Required	Description
  value	String	Yes	The field to parse into a JSON object.
  default	String	No	The fallback value if the field does not exist. Default: None (no value returned).
  restrict	Bool	No	Whether to enable restricted mode when the value is not valid JSON. Default: False. False: Ignores the error and continues transformation. Returns the default value. True: Reports an error, stops transformation, and discards the log.

• Response

  The parsed JSON object.

• Examples

  • Example 1: Parse the value of the content field into a JSON object.

    • Raw log

      content:  {"abc": 123, "xyz": "test" }

    • Transformation rule

      e_set("json", json_parse(v("content")))

    • Result

      content:  {"abc": 123, "xyz": "test" }
      json:  {"abc": 123, "xyz": "test"}

  • Example 2: Parse the content field. If the value is not valid JSON, return the default value.

    • Raw log

      content: this is not json

    • Transformation rule

      e_set("json", json_parse(v("content"), default="FFF", restrict=False))

    • Result

      content: this is not json
      json: FFF

Converts XML data to JSON.

• Syntax

  xml_to_json(source)

• Parameters

  Parameter	Type	Required	Description
  source	String	Yes	The XML field to convert.

• Response

  The converted JSON data.

• Examples

  • Raw log

    str : <data><country name="Liechtenstein"><rank>1</rank><year>2008</year><gdppc>141100</gdppc><neighbor name="Austria" direction="E"/><neighbor name="Switzerland" direction="W"/></country><country name="Singapore"><rank>4</rank><year>2011</year><gdppc>59900</gdppc><neighbor name="Malaysia" direction="N"/></country><country name="Panama"><rank>68</rank><year>2011</year><gdppc>13600</gdppc><neighbor name="Costa Rica" direction="W"/><neighbor name="Colombia" direction="E"/></country></data>

  • Transformation rule

    e_set("str_json",xml_to_json(v("str")))

  • Result

    str:<data><country name="Liechtenstein"><rank>1</rank><year>2008</year><gdppc>141100</gdppc><neighbor name="Austria" direction="E"/><neighbor name="Switzerland" direction="W"/></country><country name="Singapore"><rank>4</rank><year>2011</year><gdppc>59900</gdppc><neighbor name="Malaysia" direction="N"/></country><country name="Panama"><rank>68</rank><year>2011</year><gdppc>13600</gdppc><neighbor name="Costa Rica" direction="W"/><neighbor name="Colombia" direction="E"/></country></data>
    str_json:{"data": {"country": [{"@name": "Liechtenstein", "rank": "1", "year": "2008", "gdppc": "141100", "neighbor": [{"@name": "Austria", "@direction": "E"}, {"@name": "Switzerland", "@direction": "W"}]}, {"@name": "Singapore", "rank": "4", "year": "2011", "gdppc": "59900", "neighbor": {"@name": "Malaysia", "@direction": "N"}}, {"@name": "Panama", "rank": "68", "year": "2011", "gdppc": "13600", "neighbor": [{"@name": "Costa Rica", "@direction": "W"}, {"@name": "Colombia", "@direction": "E"}]}]}}