Formula - JsonPathKey

Use the JsonPathKey Formula function with a regular expression to extract matching Log Event Content from any of the following:

• Body - Payload
• Context - Key-Value collection
• A result from previous Formula function

Quick example

Let's get you started with the following example (Get all Keys matching the provided regular expression)

{"swagger":"2.0","info":{"version":"V1","title":"Nodinite WebAPI","x-swagger-net-version":"8.3.38.001"},"host":"localhost","basePath":"/Nodinite/Dev/WebAPI","schemes":["http"],"paths":{"/api/activedirectorygroups":{"get":{"tags":["ActiveDirectoryGroups"],"summary":"Get a list of Active Directory Groups, limited by specified input","operationId":"ActiveDirectoryGroups_List","consumes":[],"produces":["application/json","text/json"],"parameters":
...

jsonPathKey('$.paths.*', body)

/api/activedirectorygroups
/api/activedirectorygroups/{id}
/api/activedirectorygroups/{id}/isnameavailable
...

Example JSON data was copied from the Nodinite Web API Swagger definition

Features

• Extract matches using a regular expression from Json Content.

How to use

To configure the Formula plugin with the JsonPathKey function:

1. Select Formula as the expression type plugin.
2. Write down the expression to use in the 'Expression' text area with the named Key to extract jsonPathKey('$.paths.*', body)
3. Content from the Body
4. The result is displayed

Syntax

The JsonPathKey function has the following syntax:

JsonPathKey(regex('Expression'), Content)

Next Step

• RegEx
  How to Add or manage Search Fields
  How to Add or manage Log Views

Related

• Body - Extract body from the Log Event

Expression Type Plugins are used in Search Fields
What are Search Fields?
What are Search Field Expressions?
What are Message Types?
What are Log Views?