18 lines
517 B
YAML
18 lines
517 B
YAML
filter: "evt.Line.Labels.type == 'json-1'"
|
|
debug: true
|
|
onsuccess: next_stage
|
|
name: tests/base-json-extract
|
|
statics:
|
|
- parsed: message
|
|
expression: JsonExtract(evt.Line.Raw, "log")
|
|
- meta: other_field
|
|
expression: JsonExtract(evt.Line.Raw, "testfield")
|
|
- meta: program
|
|
expression: evt.Line.Labels.progrname
|
|
- parsed: extracted_array
|
|
expression: JsonExtract(evt.Line.Raw, "nested_1.anarray")
|
|
- parsed: extracted_array_field
|
|
expression: JsonExtract(evt.Line.Raw, "nested_1.anarray[0]")
|
|
|
|
|