- 3 minutes to read

JSON Path Search Field Expression Plugin

Easily extract unique values from JSON messages using the JSON Path Search Field Expression Plugin. This page shows you how to configure, test, and use this plugin with clear input, configuration, and result examples.

✅ Extract single or multiple unique values from JSON messages ✅ Use flexible JSON Path expressions to target any element or attribute ✅ Designed for high performance and self-service log views ✅ Works with REST APIs, Azure Logic Apps, and modern integration platforms

🎯 Design Note: Perfect for cloud-native integrations and microservices architectures!

What does the JSON Path plugin do?

The JSON Path plugin lets you extract one or more unique values from the payload (Body) of Log Events. Use it to process messages where data is structured as JSON, making it easy to target specific elements or attributes.

Key Features:

  • Process JSON messages and extract values using JSON Path expressions
  • Target any element or attribute in the JSON structure
  • Support for recursive descent and wildcards
  • Ideal for small to medium payloads

Use Case: Extract values from JSON messages in REST APIs, Azure Logic Apps, or cloud integration platforms.

How it works

The JSON Path plugin processes messages in three steps:

  1. Input: The JSON message payload
  2. Expression: A JSON Path expression to match values
  3. Result: Unique value(s) extracted from the message
graph LR A["Input: JSON Payload"] --> B["JSON Path Expression"] B --> C["Result: Unique Values"]

The JSON Path expression navigates the JSON structure and extracts matching values.

Example

Input:

{
  "Orders": [
    { "Id": 101 },
    { "Id": 102 }
  ]
}

Expression:

$..Id

Result:

101
102

Tip

The $..Id expression uses recursive descent to find all Id properties at any level in the JSON structure.

Test Expression Example: Valid expression with state output, unique values, and total count.

Additional examples

Example 1: Extract all Order IDs

Expression: $..Id Description: Recursive descent to find all Id properties

Example 2: Extract specific array element

Expression: $.Orders[0].Id Description: Get the first order's ID

Example 3: Extract all values from array

Expression: $.Orders[*].Id Description: Get all IDs from the Orders array

How to use the JSON Path plugin

  1. Open the Search Field Wizard from a Log View and either create a new Search Field or edit an existing one
  2. Choose the JSON Path plugin from the Expression Type dropdown
  3. Enter your JSON Path expression in the Expression field
  4. Select the Message Type(s) to apply the field
  5. Save the configuration
  6. Re-index existing data (optional)
  7. The extracted data is now available in your Log Views!

Select JSON Path plugin Example: Selecting the JSON Path plugin in the Search Field configuration.

Tip

Extracted values are stored for as long as the Message Type retention is configured.

Testing your expression

You can test your configuration in the Test Expression tab before saving:

  1. Enter a sample payload in the Message Body tab
  2. Select the JSON Path plugin
  3. Enter your JSON Path expression
  4. Review the output and adjust as needed

Successful Match: ✅ Shows matched values and extraction count.

Test Expression Example: Valid expression with state output, unique values, and total count.

No Match: ❌ Occurs when the expression is invalid or doesn't match the message content.

No Result Example: Invalid expression yielding no result.

Important considerations

Performance:

  • This plugin loads the entire message into memory
  • Use only for small to medium payloads to avoid performance issues

Alternatives for other formats:

  • Use XPath if the payload is XML
  • Use RegEx for pattern-based extraction
  • Use Formula for advanced conditional logic
  • Formula - Create expressions with conditional logic and nested expressions
  • RegEx - Pattern-based extraction for any text format
  • XPath - XML-specific extraction

Next Step