- 3 minutes to read

JSON Path Search Field Expression Plugin

The JSON Path plugin extracts Search Field values from a JSON Message Body of a Log Event with a single JSONPath expression. One expression can return a single property, every item in an array, or every property with a given name at any depth.

  • ✅ Selects properties, array items, and wildcards with standard JSONPath
  • ✅ Finds a property at any depth with recursive descent ($..Id)

When to use it

Your data Use
JSON in the Message Body JSON Path (this plugin)
JSON in a context property, or a value you need to transform or combine further Formula with the jsonPath function
XML in the Message Body XPath
Text without a JSON or XML structure RegEx

For all plugins side by side, see Choose a plugin.

Expression syntax

Select JSON Path in the Expression Type list and enter the JSONPath in the Expression field.

Expression Type list filtered on "Json", showing JSON Path
The JSON Path plugin in the Expression Type list.

Syntax Selects Example
$ The root of the JSON document $.Order
.Name A child property $.Order.OrderNumber
..Name Recursive descent: every property with that name, at any depth $..Id
[n] The array item at zero-based index n $.Order.Lines[0]
[*] Wildcard: every item in an array, or every property of an object $.Order.Lines[*].Sku
  • The leading $. is optional: Order.Status, $.Order.Status, and .Order.Status select the same property.
  • Property names are case-sensitive: order.status finds nothing in {"Order":{"Status":"Shipped"}}. A wrong case gives no value, not an error, so check the case first when a test finds nothing.

When the expression selects several values, the plugin returns each unique value once (see How expressions run). Configure the plugin in Add or manage Search Field and check the result with Test Your Expression. When the expression matches nothing, the test reports a warning instead of values:

Test result: Processed with warning, the provided expression yielded no result
The test result when the expression finds no value.

Examples

Example 1: Find every Id at any depth

Input 

{
  "Orders": [
    { "Id": 101 },
    { "Id": 102 }]
}

Expression 

$..Id

Result 

101
102

Recursive descent (..) finds the Id property in both array items.

JSON Path test where the recursive descent expression returns 101 and 102 from the Orders array
The expression $..Id returns 101 and 102.

Example 2: Extract every SKU from the order lines

Input 

{
  "Order": {
    "OrderNumber": "PO-2026-1001",
    "Customer": { "Id": "C-042", "Name": "ACME" },
    "Lines": [
      { "Sku": "WID-100", "Quantity": 5 },
      { "Sku": "WID-200", "Quantity": 2 },
      { "Sku": "WID-100", "Quantity": 1 }
    ]
  }
}

Expression 

$.Order.Lines[*].Sku

Result 

WID-100
WID-200

The wildcard [*] visits all three array items; WID-100 appears twice and is returned once.

JSON Path test: $.Order.Lines[*].Sku returns WID-100 and WID-200
Three order lines, two unique SKUs.

Example 3: Extract one property by its path

Input

The order from Example 2.

Expression 

$.Order.Customer.Id

Result 

C-042

A full path from the root selects exactly this property, even when other objects in the message also have an Id; $..Id would return all of them.

JSON Path test: $.Order.Customer.Id returns C-042
The full path returns only the customer's Id.

Next Steps