working tests for json

pkg/exprhelpers/jsonextract.go

@@ -13,9 +13,8 @@ func JsonExtractLib(jsblob string, target ...string) string {
 		jsonparser.StringToBytes(jsblob),
 		target...,
 	)
-
 	if err != nil {
-		log.Errorf("jsonExtractLib : %s", err)
+		log.Errorf("jsonExtractLib : %+v : %s", target, err)
 		return ""
 	}
 	if dataType == jsonparser.NotExist {
@@ -23,10 +22,16 @@ func JsonExtractLib(jsblob string, target ...string) string {
 		return ""
 	}
 	strvalue := string(value)
+	//debug stuff
 	return strvalue
 }
 
 func JsonExtract(jsblob string, target string) string {
+	if !strings.HasPrefix(target, "[") {
+		target = strings.Replace(target, "[", ".[", -1)
+	}
 	fullpath := strings.Split(target, ".")
+
+	log.Printf("path -> %+v", fullpath)
 	return JsonExtractLib(jsblob, fullpath...)
 }

pkg/parser/tests/base-json-extract/base-grok.yaml

@@ -9,6 +9,9 @@ statics:
     expression: JsonExtract(evt.Line.Raw, "testfield")
   - meta: program
     expression: evt.Line.Labels.progrname
-
+  - parsed: extracted_array
+    expression: JsonExtract(evt.Line.Raw, "nested_1.anarray")
+  - parsed: extracted_array_field
+    expression: JsonExtract(evt.Line.Raw, "nested_1.anarray[0]")
     
 

pkg/parser/tests/base-json-extract/base-grok2.yaml

@@ -11,4 +11,6 @@ nodes:
 statics:
   - meta: log_type
     value: parsed_testlog
+  - parsed: extracted_arrayfield_from_object
+    expression: JsonExtract(evt.Parsed.extracted_array, '[1]')
 

pkg/parser/tests/base-json-extract/test.yaml

@@ -4,7 +4,7 @@ lines:
       Labels:
         type: json-1
         progrname: my_test_prog
-      Raw: '{"testfield": "some stuff", "log": "xxheader VALUE1 trailing stuff"}'
+      Raw: '{"testfield": "some stuff", "log": "xxheader VALUE1 trailing stuff", "nested_1" : {"anarray" : ["foo","bar","xx1"], "xxx" : "zzzz"}}'
 results:
   - Meta:
       other_field: some stuff
@@ -12,5 +12,8 @@ results:
     Parsed:
       message: xxheader VALUE1 trailing stuff
       extracted_value: VALUE1
+      extracted_array_field: foo
+      extracted_array: '["foo","bar","xx1"]'
+      extracted_arrayfield_from_object: bar
     Process: true