- 2 minutes to read

Formula - JsonPathKey

Use the JsonPathKey Formula function with a regular expression to extract matching Log Event Content from any of the following:

  • Body - Payload
  • Context - Key-Value collection
  • A result from previous Formula function

Quick example

Let's get you started with the following example (Get all Keys matching the provided regular expression)

Input Expression Result 
{"swagger":"2.0","info":{"version":"V1","title":"Nodinite WebAPI","x-swagger-net-version":"8.3.38.001"},"host":"localhost","basePath":"/Nodinite/Dev/WebAPI","schemes":["http"],"paths":{"/api/activedirectorygroups":{"get":{"tags":["ActiveDirectoryGroups"],"summary":"Get a list of Active Directory Groups, limited by specified input","operationId":"ActiveDirectoryGroups_List","consumes":[],"produces":["application/json","text/json"],"parameters":
...



jsonPathKey('$.paths.*', body)


/api/activedirectorygroups
/api/activedirectorygroups/{id}
/api/activedirectorygroups/{id}/isnameavailable
...
Text Data Context Unique values

Example JSON data was copied from the Nodinite Web API Swagger definition.

Features

How to use

To configure the Formula plugin with the JsonPathKey function:

  1. Select Formula as the expression type plugin.
  2. Write down the expression to use in the 'Expression' text area with the named Key to extract jsonPathKey('$.paths.*', body)
  3. Content from the Body part of a Log Event
  4. The result is displayed Extract matches from Json content
    Here's an example of the configuration above.

Syntax

The JsonPathKey function has the following syntax:

JsonPathKey(regex('Expression'), Content)

Next Step

How to Add or manage Search Fields
How to Add or manage Log Views

Expression Type Plugins are used in Search Fields
What are Search Fields?
What are Search Field Expressions?
What are Message Types?
What are Log Views?